Game Plan for Building a Tech Supplier to Multinational Enterprises

New technologies are changing the way personal data can be used to simplify complex tasks for financial transactions, life sciences and business services and the “connected devices” of the Internet of Things. Applications Programming Interfaces (API’s) are stealing the show in data-driven businesses like FinTech, HealthTech, EduTech, drones and blockchain . There are lessons for legal, accounting, marketing, sales and tech. What have we learned?

1. Start with Compliance in Mind. If you are developing any solutions that depend on data, first identify what legal requirements your customers must satisfy, and be ready for the interrogation from the customer’s compliance department. Identify the customer’s vendor assessment procedures and be ready from the start.

• For financial tech (“FinTech”), your processes (and your business model as evidenced in your contract templates) must meet the complex regulatory requirements.
• For HealthTech, your data collection must satisfy HIPAA’s rules on data collection, storage, usage and destruction. 
• For IoT device management, you can minimize security risks by using layers of security in all devices, limiting the processing capacity of the IoT devices, putting the processing capacity in secure servers, and designing the hardware for future software and security updates. 
• For consumer data, position your servers strategically (for limiting jurisdictional long-arms) and choose self-certification for Privacy Shield or practical alternatives. 

Consider a structure that complies with the “Service Organization Controls II” ("SOC Type II") audit procedures of the AICPA for information governance (“IG”), International Standards Organization 27001 and, more generally, internal controls relevant to security, availability, processing integrity, confidentiality and privacy. Be ready for a source code escrow agreement, but maybe you can cut off such a discussion by demonstrating that there is no need because of your “robust controls” and the value of your patents (not just the value of the source code).

2. Start Lightweight for Agility and Adaptability. You can identify a spot in a complex process (e.g., customer onboarding for banks) and optimize constantly with feedback from customers. The process of customer onboarding is complicated by the need to get data from a broad spectrum of reliable data sources. If you simplify the bank’s compliance with its “know your customer” (KYC) requirements, the prohibitions on dealing with “specially designated nationals” (“SDN’s), anti-money-laundering (“AML”) rules and export and import controls, etc., you will have a big win. The “waterfall” development process works fine if everyone has time. Scrum and agile development require close controls of each iteration. Maybe you might develop an API that is more agile than scrum software, since you are integrating with multiple data sources rather than redefining existing (“old”) methods.

3. Start with Cheap or Free “Big Data”: Find Value in “Digital Exhaust.” People and businesses have become so focused on social media, mobile applications, etc. that you can mine the Internet for data that you might otherwise need to pay a data broker for. Free is better than cheap.

4. Integrate with the “Big Dogs”: Be Disruptive yet Collaborative within the Ecosystem. You can be disruptive and yet add value to enterprise customers within traditional ecosystems. Fill a gap that “big dogs” do inefficiently or with unnecessary layers of middlemen. For example, LendingClub.com uses its own customer evaluation process to generate and issue loans to qualified borrowers and then sells off the loan portfolio for a profit, shifting the future revenue stream and risks to the banks that want to purchase and administer the portfolios. As such, the traditional banks become a distribution channel for new FinTech generators of new loans as a portfolio.

5. Find and Support the Change Agent at the “Big Dogs.” Big companies are in conflict between the need to centralize controls under a CTO or CIO function and the need to be nimble and responsive to customers (the line of business functions). Your sales team should identify the “early adopters” of new technologies and new processes, as well as be in touch with the nominal head of the IT organization. Even if your big customer has appointed an “innovation” department to enable some form of novel thinking, understand that such teams might not have the capacity to be advocates of the changes that the Big Customer needs.

6. Train and Support the “Big Dogs.” Disruptive business models can easily fail without handholding (technical and commercial reinforcement) to ensure adoption and integration of change into daily processes. Don’t let the customer down. Give them a 90-day period of training, support, internal review, adaptation and consolidation of the changes. Otherwise, inertia will defeat the innovation. 

7. Use Process Automation for Low-Value, High Volume Tasks. You can get love and affection from the big banks which would prefer to spend their precious skilled resources on devising and implementing strategies for big customers for big fees. You can make good money taking care of the smaller customers whose needs are defined, repeatable, measurable, and time-sensitive and, most important, unloved and uncompensated.

8. Design for Key Performance Metrics. Whether in the Cloud or on premises, design your processes for the most important Key Performance Indicators, beyond the SOC Type II protocols. In the Cloud, flexibility in process integration across data sets and low latency seem to trump other operational factors. Keep processing fast by using few resources and avoiding unnecessary pre-processing of unnecessary data.

The success rate for the integration of disruptive data-driven businesses (typically, startups) with global enterprise customers is very modest. The chances for success can be improved if you simplify processes (at least for the end user), integrate your tools into existing Big Data and economic processes and provide customer engagement and support. If you have all this, you can look forward to faster and more positive evaluation as a qualified vendor and less angst in contract negotiations on limitations of liability, indemnification and risk management.

Cross-Border Data Flows after EU Invalidation of EU-US Safe Harbor Agreement

Stop the presses!  On October 6, 2015, the European Court of Justice invalidated the July 26, 2000 international agreement between the European Union (EU) and the United States called the “Safe Harbor” agreement.  The case, Schrems v. Facebook, Inc., arises from a complaint by an Austrian national concerned about the protection of his personal data held in the U.S. by Facebook in the wake of the 2013 disclosures by Edward Snowden regarding the sharing of personal data stored by Facebook and others with U.S. intelligence.

This decision could have a huge impact on all U.S. Internet-based businesses, all multinational businesses that collect data from EU individuals.  It may require reworking and new contracts for data center management, collection and data analytics that uses EU Big Data, social and mobile websites.

Under the Safe Harbor Agreement, U.S. companies and their EU affiliates could freely exchange EU “personal data” (concerning individuals residing in the EU), even if the U.S. did not have “adequate protection” to comply with the EU Data Protection Directive of 1995.  The Safe Harbor only required that the U.S. companies enter into an agreement with their foreign affiliates to comply with EU Data Protection mandates and to file the agreement with the U.S. Department of Commerce.

The EU Court invalidated the Safe Harbor Agreement for several reasons. The Safe Harbor Agreement fails to comply with the EU Data Protection Directive’s rules that:

• the transfer of personal data to a third country may, in principle, take place only if that third country ensures an adequate level of protection of the data;
• The EU Commission has not made a finding that the U.S. ensures an adequate level of protection by reason of its domestic law or its international commitments; and
• The U.S. has not designated any public authorities (“data protection authority”) responsible for monitoring the application within its territory of the local “national provisions” adopted on the basis of the EU directive.

Considering a potential conflict of laws between the U.S. and the European Union, in the Court’s press release No. 117/15:

the Court observes that the scheme is applicable solely to the United States undertakings which adhere to it, and United States public authorities are not themselves subject to it. Furthermore, national security, public interest and law enforcement requirements of the United States prevail over the safe harbour scheme, so that United States undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements. The United States safe harbour scheme thus enables interference, by United States public authorities, with the fundamental rights of persons, and the Commission decision does not refer either to the existence, in the United States, of rules intended to limit any such interference or to the existence of effective legal protection against the interference.

As a result, cross-border data transmission from the EU to the US could be prohibited without new U.S. federal legislation equivalent to the EU Data Protection Directive.   This will prevent social media like Facebook, data brokers, credit card companies, and consumer goods websites from storing EU personal data in the U.S.  Data stored in computers in the EU will be under the jurisdiction of EU courts.

This decision underscores the importance of a strong digital compliance program to cover not just personal data, but also digital business records.  It’s time to review your policies, procedures, roles and responsibilities, and business models.  It’s a whole new digital world!

"Pitch Night" - Tips for Innovative Start-ups

“Pitch Night” is the opportunity for startups and innovators to show their business ideas to potential investors/advisors and get feedback on their presentations. I recently attended one in the health IT sector and thought that the critiques presented by these advisors were invaluable advice, not just for this sector, but for anyone interested in exploiting a new e-business idea. I thought I would share some of these key lessons with you today:

1. Who Will Pay for Your Solution? Identify your business opportunity and target market by explaining who is in pain and willing to pay money for your pain-relieving solution.

1. Your pitch should explain:
1. “This is our customer.”
2. “Our customer base is losing money (estimated at $XX per “transaction”/ “event” for YY transactions per year) because of problems we solve. [Describe the problems.]
3. “This is why our customer will gladly pay for our solution to overcome their current chronic problems.”
2. Don’t develop “a tool in search of a problem.”
3. Talk to 100 buyers before you finalize your solution’s design. Understand how they identify their pain and what your solution does and fails to do to resolve that pain.
4. Lawyer’s caution: Be careful. If you explain the “problem that you solve,” you might be explaining the trade secret in your patent application. Think about your “inside voice” (trade secret disclosure under a non-disclsoure agreement) and your “outside, or pitch” voice.

2. Finding the Niche: Steer Away from Obvious Competition. While your solution might have a broad market, you risk losing to deep-pocket competitors who also see a broad market. So target on a niche market where you can acquire a dominating competitive advantage.

1. For large enterprises, third party administrators (TPA’s) already manage large health and wellness programs. They might not see the value of your product.
2. For smaller enterprises, the value of your technological solution might come from the combination of lower per-capital costs of managed services (normally provided by a TPA) where you combine managed administrative services (like a TPA) and the underlying technological solution in a single pricing plan.
3. Identify your “similars”: competitors who have a similar solution, and refine your solution to be different.
4. Explain why you are different and your solution cannot be accessible to your competitors: patents, trade secrets, licensing, governmental monopolies, regulations, first-mover advantage, etc.

3. Prove your Concept. Investors want to know your solution works and is accepted by at least one key “early adopter.” Develop a pilot program to gather performance metrics that demonstrate “proof of concept.”

4. Exploit your Big Data. If your innovative solution collects data (through sensors in the “Internet of Things,” a “tracking” or wearable “monitoring” devices), then develop a plan to own and commercially exploit the value of such Big Data across all your revenue streams.

1. Lawyer’s caution: Before you exploit personally identifiable information (“PII” under data privacy laws) or personal health information (“PHI” under HIPAA), adopt legal procedures for obtaining consents to use it and for securing it from hackers.
2. Design your data collection strategy based on whether it complies with privacy rights. It’s “privacy by design.”

5. Exploiting Mobility; Provide Teleservices. Design your solution for use in telemedicine. If you are selling sensors or other tracking devices and services, identify how your solution overcomes existing problems of distance, such as remote villages lacking world-class medical support, or on the ocean or in the air, or other scenarios where it is predictable that the user will lack access to adequate medical care without your solution.

6. Consider Selling to Channels, not just to Customers. A channel consists of an industry player that regularly supports your target customer’s critical needs. It might be a distributor. But it might also be a strategic buyer who has a gap in its product line and would want to integrate your solution into its solution. Find the gap. Such a strategic buyer might invest in return for some form of preferential distribution rights.

7. Sustainable User Intrigue, not Fatigue. In your sale to users, you cannot merely sell them the product and a six-pack of diagnostic data presentations from the user’s uploading of his/her data to your servers. Over time, the user will become tired because “nothing changes” after the initial use and the initial improvement. To be sustainable, you must design sustainable user demand after the initial “quick success.” Possible solutions:

1. Telemedicine
2. Real-time feedback loop for health improvement (or other benefits) when your solution collects the data from the user
3. “Emergency” alerts, dashboards and “managed care” support
4. Habit-forming disruptive self-service that simplifies life and gives it more meaning with less hassle.

Big Data, Big Abuse Potential

SMAC, n.  (1) a variation of crack-cocaine; (2) a highly addictive, volatile, potentially life-transforming multi-composite drug, sometimes used illegally, universally available in medicine, commerce, education, and family economics; (3) social, mobile, analytics and cloud computing; (4) Big Data.

On April 11, 2014, the U.S. Federal Trade Commission (FTC) announced a public “workshop” on September 15, 2014, to examine effects of Big Data on “low income and underserved consumers.”  The workshop invites comments, reports, and original research to explore current practices in the uses of Big Data on high-income consumers and privacy rights generally.  The FTC will explore concerns that been raised about whether Big Data may be used to categorize consumers in ways that may affect them unfairly, or even unlawfully. (For more info, visit their website.)

The workshop will address consumer protection issues that could result in new regulations or laws affecting virtually all companies (whether or not they are “tech companies):

• How are organizations using Big Data to categorize consumers?

• What benefits do consumers gain from these practices? Do these practices raise consumer protection concerns?

• What benefits do organizations gain from these practices? What are the social and economic impacts, both positive and negative, from the use of Big Data to categorize consumers?

• How do existing laws apply to such practices? Are there gaps in the legal framework?

• Are companies appropriately assessing the impact of big data practices on low income and underserved populations? Should additional measures be considered?

This workshop comes after the FTC examined privacy issues associated with big data practices in its 2012 report Protecting Consumer Privacy In An Era of Rapid Change: Recommendations for Businesses and Policymakers, and its ongoing examination of the data broker industry.

The proliferation of smart phones, tablets, intelligent mobile devices (including wristbands, headphones, automobiles and wearable telecom devices) and online social media have enabled the collection and analysis of huge datapoints.   The Internet of Things will include sensors (some of which are mobile) that are collecting data streams in real time.  Data brokers collect different related information that can be assembled into a mosaic of demographic information that might include race, religion, national origin, sex, sexual orientation, health conditions (subject to HIPAA), disability, veteran status and other commercially “relevant” criteria.  Big Data thus enables the pinpoint analysis of individual conduct as well as the conduct of individuals according to demographic, geographical, financial, educational and economic variables.

The FTC is looking at issues of the use of insights from Big Data (including credit risk scores, demographic information and other assessments) for illegal purposes.  While the FTC has been clear about potential abuses by financial institutions, the issues apply to all companies using Big Data.

Business executives (and law departments) should be asking how their own practices of collecting, analyzing and using Big Data might be abusive or illegal.

Now is a good time to conduct an internal review of your Big Data strategies.

• What criteria do you use for market segmentation?  Consider how you use any Big Data (or direct customer data) in a manner that might discriminate against certain demographics in pricing, new product availability, service priority, credit card lines of credit, retirement account services, financial services, volume discounts, “early bird” or “favored customer” sales.

• What criteria do you use for making preferential offers?  Do you limit access to “unfavored” customers in terms of access to higher quality products, services or content?

• What policies do you have that might create (intentionally or not) a “disparate impact” (which, under one theory of law enformceemnt, constitutes intentional wrongful discrimination)?

• Have you integrated your Big Data initiatives with your corporate social responsibility (CSR) and governance, risk management and compliance (GRC) programs.

Could an International Trade War on Privacy Rights for Online Businesses be Heating Up?

Privacy and data protection are synonymous with the “good life” of e-commerce, when online businesses are free to use consumer data with little restrictions.  But with technological advances and the explosive growth of e-commerce, this area invites extraterritorial regulation by foreign governments across borders.  I’m concerned that this web of web regulations will be totally inconsistent, unmanageable and lead to significant costs and lost opportunities for e-businesses.  Consumer protection should not become a mandate for imposing bureaucracy and “free” content management services.

EU Harmony.  In January 2012, the EU announced proposed reforms to its 1995 data protection rules in order to further strengthen online privacy rights and regulate the enormous growth of data collection and processing over the internet in this age of mobile and social computing, the Internet of Things, Big Data and related analytics.  In short, these reforms proposed:

• a single set of rules to apply across the EU and its administration by a single national data authority within the home EU country with the power to impose fines for non-compliance. 
• In addition, EU people will have greater privacy rights, including the “right to be forgotten” and the “right to port their data” across service providers. 
• EU rules would apply in cross-border transactions for companies in non-EU countries handling services to EU citizens.  Any serious data breaches would have to be reported to authorities as soon as feasible within 24 hours.  Additional costs would be incurred by businesses.

Since then, some EU member nations, major tech companies and other countries have criticized the proposal as being too restrictive and a burdensome expense for (especially small) companies..  Nevertheless, the EU continues to move forward with an amended draft likely to happen later this year with the objective of implementing a Regulation governing its member nations in 2014.

American Federalism:  A Hodge Podge.   In contrast, American federal laws (see https://www.cdt.org/privacy/guide/protect/laws.php) are generally weaker than European and other countries’ laws in the field of consumer protection for data privacy and the “private life.”  A year after the Obama administration called for a draft of a consumer privacy bill of rights, none has been completed or made public.  There are no baseline privacy laws protecting consumers. Instead there are sector specific privacy laws and self regulated company privacy policies; consumer privacy laws vary by state (see http://www.ncsl.org/issues-research/telecom/state-laws-related-to-internet-privacy.aspx).  Those who support this hodge podge of laws insist that these methods encourage free commerce and growth of online businesses.

New Balance: International Agreement or International Chaos?   There is no free lunch.  My concern is that privacy laws will be so onerous, complex and confusing that it will balkanize the Internet, preventing cross-border transactions and increasing the hurdles for Internet entrepreneurship of small and mid-sized businesses.  Consumer protection and data privacy laws will conflict with business, adding costs that will have to be passed along to the consumer in the form of higher prices, more advertising per view, and less innovation.  Should the EU adopt its proposed reforms independently, American companies could find themselves subject to EU regulations when conducting cross-border transactions with EU citizens even if there is no conflict with American laws. 

I believe that every nation should have “baseline” privacy rules, including the US, but I wouldn’t go as far as the proposed EU reforms.   Businesses and/or consumers alike have a:

• Right to know what data is being collected and aggregated about them

• “right to be forgotten” but only where the user pays the cost of undoing what the user posted “for free”
• copyright in posted content and a right to transfer one’s post to other providers, for a reasonable porting fee
• right to know what data is known by a service provider and the right to correct it.

The US and EU are set to begin negotiations for a free trade agreement June 2013.  Hopefully common agreement on data protection and privacy rules will be a part of it.  More on this subject later.

The Hot “New” Value of Copyrights for SaaS and other Software Apps

What’s the most cost-effective, practical way to protect intellectual property for your cool mobile app or your SaaS e-business?   The answer just changed as of March 16, 2013.   

Since this date, getting patent protection became harder.  Now, the first inventor to file a patent application will be recognized as the inventor of this U.S. patent, and the “first to invent” priority rule will no longer apply under the America Invents Act, enacted September 16, 2011.  A number of other changes became effective as well:  “prior art” now includes foreign publications.  In short, getting a U.S. patent will require more vigilance and investment in the patenting process.  And enforcing/defending a patent could still cost over $1.0 million or more. 

So is now the right time for a resurgence of copyright applications for software to protect intellectual property rights?   Yes, perhaps.  While copyrights cannot replace patents as a legal monopoly, for the smaller business or entrepreneur with limited funding and wanting a quick certification of ownership, copyright offers a simple, cost-effective solution. 

Unlike patents (which protect innovative ideas), copyrights only protect the particular expression of an idea, such as a story, or a software application.  There is some room for additional copyright protection against plagiarized “derivative” works, but not much, since the author of the “derivative” work need only show a minimal level of originality to defeat a claim of plagiarism. 

But, copyrights still have a lot of value.  A copyright owner can prevent others from copying and marketing clone software or even a clone product catalog.  You don’t need to register to own the copyright, but registration helps with enforcement.  The owner of a registered U.S. copyright can sue for damages and collect attorney’s fees.  (Owners of trade secrets can only sue for damages and normally cannot collect attorneys’ fees).  And you can register the copyright with U.S. customs authorities to prevent the importation of infringing products.  All this is a powerful incentive for preventing knock-offs.  The U.S. online copyright filing fee is only $35 per basic claim of authorship.

But, done wrong, registering a copyright can risk losing trade secret and/or patent rights.  If you deposit a copy of your source code for the app with the U.S. Copyright Office, it risks making public your confidential secret sauce, which would normally defeat trade secrecy and could endanger an unfiled patent application.  Done right, however, your copyright registration can avoid that risk by careful planning and limited disclosure of the secret sauce. 

Your copyright registration program should fit within a more holistic overall program to protect intellectual property including trade secrets.  The copyright deposit materials could be machine-readable object code, so that it becomes indecipherable without an operating system and a computer language.  Or the deposit materials could be fractions of a printout of the code.  All you need to do is prove that it compiles, and do it in a manner that prevents anyone from decoding.   Special rules apply, though, for apps that are derivative works or include some open-source components.

For low-cost and high legal value, copyright registration may become the method of choice for entrepreneurs and small app developers.   Patents should still be pursued as a defensive measure, but copyrights can be an important part of the plan.