U.S. National Security Regulation of Information Technology Supply Chains and IT Infrastructure as a Service: (CFIUS-Style National Security Review for Cloud Computing, Software, Hardware, SaaS, IoT and Other Tech-Enabled Devices)

Regulation of IT Supply Chain after January 19, 2021 and after SolarWinds

On January 19, 2021, as a final act of the departing Trump administration, the Department of Commerce published an interim final rule (the “Rule”) and President Trump signed an Executive Order (the “Order”) to regulate U.S. information technology (“IT”) companies in transactions with foreign actors.  Entitled “Securing the Information and Communications Technology and Services Supply Chain,” the Rule is based on delegated authority under the International Emergency Economic Powers Act. The Order expands on an Executive Order issued May 15, 2019.   The Rule coincides with newspaper reports that some U.S. governmental agencies and other tech services companies downloaded malicious software from SolarWinds, a Texas tech services company reportedly with over 18,000 customers, that appears to have been hacked by foreign hackers.

Summary of New ITSC Regulation

As of January 19, 2021, any American business’s purchase of Information and Communications Technology and Services (“ICTS”) from “persons owned, controlled our under the jurisdiction or direction” of a “foreign adversary” is subject to a Commerce Department review for national security and critical dependency risks.  The Rule covers all ICTS Transactions where the tech or services are “designed, developed, manufactured or supplied” by such persons.  The Rule seeks to protect the American IT supply chain (“ITSC”).  No exemptions apply, regardless of your company’s size, industry or activities.  

The 2021 ITSC Rule follows the policies reflected in the 2018 amendments to laws governing virtually all foreign acquisitions of U.S. tech companies, under scrutiny for national security by the Committee on Foreign Investment in the United States (“CFIUS”).  To avoid duplication, the Rule states it does not apply to ICTS Transactions that CFIUS is actively reviewing, unless the ICTS Transaction is distinct from a CFIUS-reviewed transaction.  Like the CFIUS review process, the Commerce Department can identify a mechanism and relevant factors for the negotiation of agreements to mitigate concerns raised in connection with the Order.

The ITSC Rule

Scope of ITSC Transactions

Virtually every digital service and product is covered, regardless whether it handles a single computer, a computer network, cloud service, telecommunications switches or just individual product data.

Definition of ICTS.  The Rule defines “Information and communications technology or services or ICTS” to mean “any hardware, software, or other product or service, including cloud-computing services, primarily intended to fulfill or enable the function of information or data processing, storage, retrieval, or communication by electronic means (including electromagnetic, magnetic, and photonic), including through transmission, storage, or display.”

Definition of ICTS Transaction.  Under the Rule, “ICTS Transaction” means any acquisition, importation, transfer, installation, dealing in, or use of any information and communications technology or service, including ongoing activities, such as managed services, data transmission, software updates, repairs, or the platforming or data hosting of applications for consumer download. An ICTS Transaction includes any other transaction, the structure of which is designed or intended to evade or circumvent the application of the Executive Order.”

Broad Scope.  In its preliminary discussion of ITSC vulnerabilities, the Commerce Department clearly intended to include SaaS (software as a service), Infrastructure as a Service, Cloud data storage and computing, IoT Internet-devices embedded in consumer goods, mobile phones and their Apps, Web browsers, drones and networked surveillance cameras.  

“Foreign Adversaries.”  The list of “foreign adversaries” consists of the following foreign governments and non-government persons: the People's Republic of China, including the Hong Kong Special Administrative Region; the Republic of Cuba; the Islamic Republic of Iran; the Democratic People's Republic of Korea; the Russian Federation; and Venezuelan politician Nicolás Maduro (Maduro Regime).

Effective Date of Rule

The Rule applies to any ICTS Transaction that is initiated, pending, or completed on or after January 19, 2021.  Further, any act or service with respect to an ICTS Transaction, such as execution of any provision of a managed services contract or installation of software updates, is an ICTS Transaction on the date that the service or update is provided.

Future Compliance Impact

The ITSC Rule imposes potentially costly compliance obligations for risk identification, assessment and regulatory licensing.  The Rule serves as a boycott of technologies from “foreign adversaries” unless approved by a Commerce Department license.  There are civil and criminal penalties, but prosecution of millions of small businesses is not practical.  Assuming the Biden Administration pursues the Rule, the scope will change the landscape for everyone, including our foreign trading partners, with potential retaliation by “foreign adversaries.”

If implemented, the ITSC Rule will likely generate a hornet’s nest in the business world and international politics.  But the reported SolarWinds hacking supports the logic of greater transparency in IT supply chains.

ICT Company Burdens.  ICT providers will need to verify countries of origin and give warranties about their extended ICT supply chains.  Even absent a legal requirement, there will be an increased need to document supply chain risk management analysis in the event an ITSC transaction is investigated by the Commerce Department.  ICT services companies must now identify the nationality, origin, foreign control and sensitivity of data that flow through their digital infrastructures.   

Corporate Governance.  Corporate boards, officers, purchasing and procurement departments and strategic planners will need to identify the risks across a potentially multi-layered IT supply chain.  How much should a board spend on verification?  Is an ICTS supplier’s self-certification sufficient?  Will an independent sourcing audit become the norm?  What should be the policy, the process and the budget?

Information Governance.  New Information Governance ("IG") policies and procedures will be needed for ITSC risk management and regulatory licensing compliance.

Privacy and Cyber-Security Risk Management.  The ITSC Rule will highlight special risk management procedures, and perhaps insurance, that relate to compliance with privacy laws, such as the California Consumer Privacy Act (to be replaced in 2023 by a Consumer Privacy Rights Act) and potentially EU’s GDPR and draft Digital Services Act.

Antitrust and Competition Law.  If Google or other dominant market player were to insist that its European subsidiaries buy only from suppliers complying with the ITSC Rule, that would have the effect of exporting American ITSC risk management compliance.  Foreign local suppliers sourcing from a “foreign adversary” would be barred.  This would be a secondary boycott unless a Commerce Department license were granted.

Best Practices for Vetting: Know Your IT Service Provider.  If they don’t already do so, enterprise customers will include an ITSC Transaction questionnaire in their requests for proposals, requests for quotations and master services agreements.  ICT agreements will include warranties and rights to audit and inspect supply chain information.  Chief Information Security Officers (CISO’s) will push for more certifications by “ethical hackers” -- independent third party testers of malware – and perhaps even direct testing.

Redrawing Supply Chains and Strategic Alliances.  Geographic and national security issues will translate into modifications in supply chains, starting with digital business models and leading into all enterprise strategic alliances, global business services, outsourcing services providers and shared services centers.  Procurement and IT departments will also examine the impact across strategic sourcing, supplier management, assessment of third party risks, artificial intelligence and robotic/intelligent process automation.

M&A and Corporate Finance.  New representations and warranties will appear in die diligence and documentation for business valuation, corporate finance and M&A transactions.

Audits.  Accountants will require ITSC audits before certifying or commenting on financial statements, which could include disclaimers as to an entity’s viability due to “incomplete” ITSC disclosures.

Cyber-risks, Hacking, Cyber-Security and Privacy.  The new Rule concerns national security, digital security, privacy and extortion.  “This [potential] data exfiltration—supported by U.S. web data hosting and storage servers—threatens to allow foreign adversaries to exploit Americans' personal and proprietary information by allowing a foreign adversary to track the locations of Americans, build dossiers of sensitive personal data for blackmail, and conduct corporate espionage from inside the borders of the United States.” Cyber-insurance policies will need to be revised to impose underwriting constraints and higher premiums on non-conforming insured enterprises.

International Trade Agreements.  In light of the reported SolarWinds hacking, President Biden will need to decide how stringently to enforce the Trump administration’s ICTS Rule.  New trade agreements might create group action against the same “foreign adversaries.”  Conflicts with allies may arise as to ICT products designed or manufactured in a trade ally country by a subsidiary from a “foreign adversary.”  For example, the Chinese tech company Huawei is planning to build 5G telecom products in France, potentially for sale to other trade allies.

How to Get a Department of Commerce License.  

Assuming a company plans to update or sign up for any "foreign adversary" technologies, a license will be needed.  To afford parties greater certainty, the Commerce Department intends to publish, within 60 days after January 19, procedures to allow a party or parties to a proposed, pending, or ongoing ICTS Transaction to seek a license.  Implementation is scheduled within 120 days after January 19.  The change from President Trump to President Biden will determine how this Rule plays out in March and May 2021.

This summary is not legal advice.  These matters are subject to change.  If you have any questions or comments, please feel free to contact us. (C) 2021 W.Bierce.

     

Risk Management and Resiliency Planning (Privacy Alert) a Year on First Anniversary of GDPR (and six months before the California Consumer Privacy Act (“CCPA”) becomes effective)

One year after the European Union's General Data Protection Regulation (“GDPR”) effective date of May 25, 2018, two years after GDPR was adopted as EU law, can we hope that the GDPR will just go away? No, that’s wishful thinking. As of February 2019, 59,000 GDPR violations had been reported, with only about 71 enforcement actions. According to several surveys, less than 50% of American businesses are GDPR compliant.

Any implied “grace period” for non-compliance is rapidly coming to an end. You are entering the twilight zone of intentional or grossly negligent non-compliance with GDPR if you are a closely-held businesses with cross-border operations, any global digital business, digital media service provider, a website collecting user information, social media marketers, mailing-list managers (whether using customer relationship management (CRM) software or Outlook or Gmail), anyone uploading data to a “war room” (virtual data room (VDR)).

How do you get really started? It’s time for data mapping, IT risk assessment and mitigation plans, corporate risk management and resiliency plans, especially for privately owned companies such as startups, family-owned business, professional service providers (such as law firms, accounting firms, consultants and financial advisors).

Hidden Risks from Hiding (or Making False Promises that You are Compliant). By when you really need to be fully compliant? Escapism and non-compliance will work for those with short lists of customers, colleagues, foreign friends and low revenues. For those with more than a half million in revenues, you need to be compliant as soon as possible. But SMB’s need to think about special reasons for immediate compliance:

• Lenders. Bank lenders want to maintain your value as an ongoing business, both to demonstrate their own prudent (regulated) lending practices and to prevent a loss of value (such as fines or reputational damage) that might impair “loan-to-value” ratios. You might not be able to get bank financing (or any financing at all) if you cannot represent and warrant that you are in regulatory compliance, with particular reference to privacy laws.
• Investors. Business angels, venture capitalists and private equity investors will want the same assurances, since the value of their equity investment (and opportunity for an eventual exit by M&A) will decline.
• Co-Shareholders. If you are a member of the Board of Directors of a corporation (or manager of a normal LLC), you have a fiduciary duty to be prudent.
• Global Enterprise Customers. Global enterprises that are your customers and clients are already including “flow-down” mandates in their Master Services Agreements (MSA’s) and requirements for Requests for Proposals (RFP). Some might allow no change in your legal obligations until the expiration of your existing contracts. But if your MSA requires you to generally comply with all applicable laws, your enterprise customer will likely be entitled to cancel your deal unless you provide new assurances…including the right of the customer to audit your security and confidentiality covenants.
• Loss of Clientele of Publicly Traded Clients and Customers. Under federal securities laws, a publicly-traded company that neglects its legal obligations under GDPR is subject to fines for false or fraudulent disclosures. Whenever a public company’s stock price drops rapidly due to some surprise to investors, the class action litigators file a lawsuit for punitive damages due to breach of fiduciary duty. The directors of public companies thus have no choice but to adopt GDPR compliance and enforce it throughout their global supply chains.
• Valuation for Sale, Change of Control or Family “Transmission” (Estate Planning). If you are transferring your business in a sale, or inheritance context, you might consider non-compliance as a valuation risk. In valuation of private companies, a discount should apply for known risks of non-compliance with rules that could have a material adverse impact. “Uncertainty as to the stability or continuity of the future income from a property decreases its value by increasing the risk of loss of earnings and value in the future.” IRS Revenue Ruling 59-50, 1959-1 CB 237. The valuation discount become dramatic when one considers the potential impact of an actual security breach, data breach notification costs, indemnification of users, a year’s free access to reputation management services for each affected EU user.
• Financial Audit. Financial auditors have begun asking questions about privacy compliance because the auditor’s role is to identify material risks to your company’s viability. A qualified financial auditor’s opinion may constitute a breach of covenant under your revolving credit loan. It might trigger an event of default under a commercial, financial, investment or other transactional documents.
• Reputational Risks. A data security breach puts your reputation at risk. You might lose clients, employees or existing or prospective business partners. Further, restoring your reputation will be difficult, costly and potentially impossible. Even if you have strong cybersecurity, you should manage the risk by planning your message, your notifications and your story before the breach.
• Vicarious Liability for Defaults of Your Suppliers. Like the EU’s 1995 Data Protection Directive, GDPR makes you liable for the personal data breaches of your suppliers at any level of your supply chain. The CCPA does the same.
• False Advertising. Under the Federal Trade Commission’s rule on false advertising, if you advertise anything about privacy and it’s not true, that’s a violation of federal law.

How can I get compliant? You must change your perspective and re-think your attitude. The GDPR calls for “privacy by design.” Rethink your entire business operations for digital compliance (and, later, for digital services taxation in cross-border and U.S. interstate services). If you receive personal information about European residents, you must comply, or at least have a plan for compliance that is credible for purposes of mitigating damages.

• Data Mapping. First, you need to know your data flows and where your data is stored. If you already know your sources and uses of funds in your accounting statements, you can understand the sources and uses of private data as well as its full life cycle of collection, processing, storage, end of useful life and destruction. 
• Informed and Updated Consents of Users. Update your terms of use and privacy conditions. Data Management. Adopt and implement policies for managing personal data, for “privacy by design” and implementation. Do you need to receive personal data? If you receive IP addresses, will that constitute “personal data” under the circumstances? Can you operate using some form of anonymization?
• Data Security. Security starts at home and ends with your suppliers at all levels.
• Data Transfers. Sharing of personal data with others is a risk.
• Corporate Governance: Policy Adoption and Enforcement. Privacy compliance is for Board review and action. They can be held responsible for breaches.
• IT Governance. Every IT contract needs a privacy clause.
• Procurement Governance. Every procurement contract needs a privacy clause.
• Training. Every employee should be trained not only on cyber-security, but also on legal compliance obligations.
• Audit and Certification. For credibility, it’s advisable to conduct privacy audits. They will help identify weaknesses and can lead to certification, thus preserving customer confidence. As with financial auditing, the individuals responsible for compliance should not be auditing the systems and procedure they have designed and implemented.
• Disaster Recovery Plan / Business Continuity Plan. Such plans are expected in any supply chain. So be ready.

In conclusion, the first anniversary of GDPR marks perhaps the end of any implied grace period, or period of ramp-up of enforcement capabilities of the EU’s data protection agencies.

Board of Directors’ Governance Duties on Privacy, Compliance and Sexual Harassment: How to avoid “Falling Flat on your Facebook”

Corporate Directors must manage the company for the best in interests of stockholders and, in general, to ensure the company complies with its regulatory and contractual obligations.  Today, every company undertakes some digital transformation, using Cloud, social media, mobile devices, Big Data, analytics and potentially virtual reality, augmented reality, robotic process automation and sensor-driven “Internet of Things” like self-driving vehicles and remote controls using mobile devices. But the benefits of digital transformation come with many disruptive risks such as cyber security breaches, privacy violations that will cost serious money under the EU’s General Data Protection Regulation effective May 25, 2018, etc.  The scalability of tech “solutions” invites hackers and thieves.  At best, the company’s reputation is tarnished.

In a new threatening world, the “business judgment” rule protecting corporate directors and officers from personal liability requires greater vigilance and broader risk management.  A corporate director’s personal liability for the misdeeds of the corporation and its employees depends on how well the director planned for and responds to the “inevitable” corporate governance disaster such as:

• Neglect of safety of its workers or consumers using a useful but potential dangerous product;
• Abuses of consumer trust, such as setting up fictitious bank accounts to reward employees, without customer knowledge;
• A claim of persistent sexual harassment by the CEO (à la Steve Wynn) or;
• A business model based on unrestrained data aggregation and the “unforeseen” problem of unauthorized access or use by an authorized third parties data broker to the personal data of millions of online subscribers worldwide (à la Facebook and Cambridge Analytica).

Here are my suggestions for good corporate governance, risk management and compliance in response to digital transformation.  Just as lawyers have a duties of confidentiality and competency in technology, corporate directors have a duty of risk identification and threat management.

1. Maintaining Independent Judgment despite Lack of Control Anticipating

It may be impossible to fulfill the directors’ duty of loyalty and to maintain one’s independent judgment if the CEO owns a majority of voting control of the company’s voting shares.  That’s the case for Facebook, where Mark Zuckerberg, founder and CEO, owns about 10% of the shares but controls a majority of voting rights.  If you displease the CEO, you could get fired from the board of a valuable and prestigious company.  If you don’t displease the CEO, you might not have exercised independent judgment.   So you need to identify and implement measures that will be best for the company, which could include mandating certain actions by the CEO who is in control of your position as director.  And your D&O insurance carrier expects nothing less so as to mitigate any payouts on the inevitable derivative claims by shareholders.

2. Identify Worst Scenarios for Your Particular Business and Your Value Chain

From an insurer’s perspective, risk management requires identification and assessment of risks for probability and adverse impact. The digital economy increases the number and nature of risks.

Public companies must identify their risk profile in their quarterly and annual SEC reports.  Private companies must likewise disclose key risks on private placement memoranda, loan applications, and prospective acquirers in shareholder meetings under the principle of shareholder democracy.  For Wynn Resorts, an empire built on gambling casinos and flashy entertainment, the risks of sexual predation by the founder, who has access to private suites and private transportation, was predictable to directors who focus on high-probability risk analysis.   For Facebook, a director who understands the business model of vacuuming personal data from subscribers and their network of “friends” for resale to “data consolidators” like Cambridge Analytica could predict a failure of accountability in the value chain.  At a minimum, all supply chain contracts should guarantee that the corporation’s trusted data and business secrets will be protected and that any governmental mandates (such as privacy protections) applicable to the supplier’s services should flow down to the supplier.

Since worst case scenarios change over time, anticipating how changes in laws, politics and public opinion becomes part of the director’s job too.  No one asked, but it’s your duty to worry and plan.

3. Insulate and Compartmentalize Processes; Identify Failure Switches

The Titanic sank because it hit an iceberg at high speed at night.  Appropriately, the captain went down with the ship, but so did many hundreds more.  The ship was designed to withstand four breached compartments, but not five.  The lessons today are, don’t accelerate in risky waters and insulate and compartmentalize to insulate the business operation from cumulative, cascading risks.

For international companies, a private cloud might effectively limit risk.  Minimization of cross-border transfers of sensitive personal data can be done by using multiple servers, two in each country (the second is for failover).   Insulation can also be achieved by pseudonymization, a new concept advocated by the EU’s GDPR that stops short of full encryption but achieves compliance … until the code is broken.

4. Incentivize Prudent Behaviors by Employees

Wells Fargo made the mistake of incentivizing its bank branch officers to create new accounts not requested by the customers.  The IT department and compliance departments were asleep and could have stopped this fraud.  While few customers were adversely affected, some suffered.  So, prudent employees should be rewarded for not taking excessive risks and, in a complex organization, be encouraged to question the validity and prudence of decisions in other departments, especially where teamwork is needed for global integration.  And maybe consider small penalties for thoughtless behaviors, like opening spam attachments.

5. Monitor Compliance by Internal and External Audits

An airtight outsourcing service agreement does not guarantee compliance.   In the world of “Tech As A Service,” SaaS agreements should still require service providers to hire trusted independent external auditors for cybersecurity and business process management.   Audits under SSAE 16 type 2 and ISO compliance principles are no guarantee, but they help demonstrate prudent business judgment.

6. Appointing Compliance Officer Reporting to the Board

While compliance should be built into the company’s DNA through leadership at the top and company policy manuals, appointing an internal auditor and compliance office can give the directors access to someone who worries for them.

7. Run Away at Your Own Risk

Normally, a director has the remedy of resigning as director in case of policy differences that cannot be reconciled.  But running away might not be possible.   In tort law, the doctrine of “last clear chance” imposes liability on the actor who fails to use all reasonable efforts, at the last minute before a disaster, to protect the imminent victim from a third-party’s foreseeable misdeeds.  In corporate law, the fiduciary duty of loyalty may include a duty to not leave the corporation stranded when it falls into difficulties, since a new director might not be able to rectify the problems as quickly as the knowledgeable director seeking to walk away.   So the director’s job is never done, especially if there is no easy alternative but to persevere in the exercise of prudent business judgment.  No one hired you to quit when the risks are high and no one else can do a quick turn-around.

8. Identify Your Goals as Director and Apply Early Warning Systems

In the 1960’s, the NORAD “distant early warning” system deployed advanced radar to identify incoming hostile missiles.  Today’s corporate director needs a system for identifying goals personally and for the corporation, with metrics, triggers and analytics for situations hostile to the corporation.  If you don’t have the time or courage to set up your own warning systems, you might consider letting someone else do the job.  Or characterize your role as “just an advisor” to the board.

Strategic Minimal Investments in Cybersecurity and IoT

Today’s cybersecurity challenges remind me of “Frog and Toad” children stories, where Frog and Toad are debating how to stop eating all the cookies right away.  They concoct a plan to put the cookies in a jar in a high cabinet where they can’t reach…easily.  But someone can always reach.   You can’t even trust yourself sometimes, so can you trust your buddy? 

Cybersecurity concerns every facet of modern life, from children’s toys to self-driving automobiles and every consumer transaction.  Cybersecurity threats will worsen with the Internet of Things, as millions and billions of sensors will collect and perform comparisons and data analytics to some data center.  Analytics will help move from data chaos to predictive strategies.

Prudent risk management requires diversification of risk.   Consumers and businesses alike need to use caution in approaching investments in sensors and IoT.  Access rights to a sensor that combines sensitive personal data with controls for the household or factory would increase the risks of abuses by employees as well as hostile hackers.

The Department of Justice’s guidebook on anticipating and dealing with data security breaches (Best Practices for Victim Response and Reporting of Cyber Incidents, published April 29, 2015, http://1.usa.gov/1I0QxAl) highlights how every business needs to adopt prudent risk management, particularly supply chain risk management, in their business.  As a contract attorney in technology businesses (and former high school wrestler), I am reminded of my coach’s advice: stick to the basics, and do them exceedingly well, and also anticipate your adversary’s expectations so you have a plan to defeat the “normal” expectation. 

Today, private equity and venture capital (and strategic acquirers) are targeting cybersecurity companies for investment and acquisition.  We all have to buy cybersecurity  or be at risk of tremendous damage to brand goodwill, fines and even monitoring. 

How much should private industry collaborate to deal with privacy challenges?  On one hand the government is offering to share security risk data with private industry (See H.R. 1560, a bill to improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats (passed by the House of Representatives on April 22, 2015) and H.R. 1731, a bill to amend the Homeland Security Act of 2002 to enhance multi-directional sharing of information related to cybersecurity risks and strengthen privacy and civil liberties protections (passed by the House of Representatives on April 23, 2015).  The ACLU opposes enhanced sharing as an invasion of civil liberties and inviting private abuses of shared information.

On the other hand, private industry can do that job without yielding data that could be abused.  The flip side of security is the question of trust: whom can you trust, and for how long?

So, for business and consumers, it’s time to consider whether the hassles and additional marginal costs of encrypting data are a better investment than high-premium cyber-risk insurance, traditional loss prevention and recovery methods. 

And, as a matter of information governance and Internet safety, every investment in cybersecurity would be wise.  The simpler the better.

“Airtight” Online “Terms of Use” via Clickwrap or Browsewrap

Do you know the differences between a “clickwrap” agreement and a “browse-wrap” agreement?  If you don’t, you might be unable to enforce your website’s “terms of use.”  In either case, it might be time to redesign your Website’s legal links to ensure they are valid contracts enforceable against your users.

In a recent decision, the U.S. Court of Appeals for the Ninth Circuit upheld an earlier ruling (Nguyen v. Barnes & Noble, Inc., USDC, C.D. California, Aug. 28, 2012) that an online customer at an e-commerce website did not agree to the website’s terms and conditions governing website use and sale of goods, even though there was a conspicuous hyperlink on every page to the website’s “Terms of Use.”   Nguyen v. Barnes & Noble, Inc. (9th Cir. Aug. 18, 2014).  The court held that the user never gave valid binding consent to arbitration or choice of law terms, because (1) the user did not click on the “Terms of Use”, (2) there was “no notice to users” that they were entering into a contract by using the website, and (3) there was no prompt to users to take any affirmative action to demonstrate assent to formation of a contract.  As a result, the website owner was unable to rely upon the Terms of Use, and the consumer was entitled to sue in court for claims arising out of a failed online commercial purchase.

For website users, the decision encourages never clicking on any hyperlinks relating to “terms of use”, “privacy,” “legal conditions” or other hyperlinks customarily posted by website owners.  For website owners, the decision is a wake-up call to immediately change the layout and functioning of the “terms of use,” “legal conditions,” “privacy” and other warnings.

In Nguyen, the court reminded the parties that there are only two flavors of contracts formed on the Internet.

• Under “clickwrap” (or “click-through”) agreements, website users are required to click on an “I agree” box after being presented with a list of terms and conditions of use.
• Under “browse-wrap” agreements, a website’s terms and conditions of use are generally posted on the website via a hyperlink at the bottom of the page, but there is no functionality requiring the user to manifest assent to the terms and conditions expressly.  Because there is no affirmative duty to express such assent, the determination of the validity of the browse-wrap contract depends on whether the user has actual or constructive knowledge of the website’s terms and conditions.  (Such knowledge may be presented on the website or may be given later, in the form of a mailed notice of breach and demand for cure.  Without such knowledge, there is no online contract.

The Nguyen decision did not address whether the website user is deemed to have assented to the website’s privacy policy.   However, the same principles could apply if the user were to argue that she had no actual knowledge of the privacy policy and never assented to the use of cookies, pixel tags, metadata analysis, profiling or other clandestine surveillance, or the re-transfer of personal information to third parties.

To ensure actual consent, the Court warned that “the onus must be on website owners to put users on notice of the terms to which they wish to bind consumers.”  Website owners now must be more “aggressive” or “unfriendly” by giving “actual notice” of the terms and demanding either a clickwrap or a browse-wrap agreement.  “User experience” (“UX”) engineers must now find solutions to keep the website user engaged and in a positive mood, while ensuring that the user is aware of the terms of use and consents to such terms.

One solution involves delaying an “I agree” button (or a display of actual terms of use) until the user is ready to make a purchase or submit information.  But that probably is too late, since the website owner will want to keep any dispute (even as to pre-purchase website usage) out of court and limited to applicable law and a chosen arbitral forum.

Another solution is to force a “pop-up” “I consent” when the user wants to leave the home page.  This could work for privacy matters as well so long as no customer profiling information (from cookies, etc.) were collected at the landing page.  That would require a change in search engine optimization and metatagging customs.  Or “Privacy” might be incorporated into “Terms of Use” to reduce the number of “approval” clicks by users.

A third solution might involve displaying a “Website Terms of Service” button that states “By clicking here, you are indicating that you have read and agree to the Terms of Service.”

The bottom line: “Whether a user has inquiry notice of a browsewrap agreement,  in turn, depends on the design and content of the website and agreement’s webpage.”  Slip opinion, p. 12.  This decision invites everyone to review and perhaps to redesign the legal framework for their online website-based legal agreements.

Big Data, Big Abuse Potential

SMAC, n.  (1) a variation of crack-cocaine; (2) a highly addictive, volatile, potentially life-transforming multi-composite drug, sometimes used illegally, universally available in medicine, commerce, education, and family economics; (3) social, mobile, analytics and cloud computing; (4) Big Data.

On April 11, 2014, the U.S. Federal Trade Commission (FTC) announced a public “workshop” on September 15, 2014, to examine effects of Big Data on “low income and underserved consumers.”  The workshop invites comments, reports, and original research to explore current practices in the uses of Big Data on high-income consumers and privacy rights generally.  The FTC will explore concerns that been raised about whether Big Data may be used to categorize consumers in ways that may affect them unfairly, or even unlawfully. (For more info, visit their website.)

The workshop will address consumer protection issues that could result in new regulations or laws affecting virtually all companies (whether or not they are “tech companies):

• How are organizations using Big Data to categorize consumers?

• What benefits do consumers gain from these practices? Do these practices raise consumer protection concerns?

• What benefits do organizations gain from these practices? What are the social and economic impacts, both positive and negative, from the use of Big Data to categorize consumers?

• How do existing laws apply to such practices? Are there gaps in the legal framework?

• Are companies appropriately assessing the impact of big data practices on low income and underserved populations? Should additional measures be considered?

This workshop comes after the FTC examined privacy issues associated with big data practices in its 2012 report Protecting Consumer Privacy In An Era of Rapid Change: Recommendations for Businesses and Policymakers, and its ongoing examination of the data broker industry.

The proliferation of smart phones, tablets, intelligent mobile devices (including wristbands, headphones, automobiles and wearable telecom devices) and online social media have enabled the collection and analysis of huge datapoints.   The Internet of Things will include sensors (some of which are mobile) that are collecting data streams in real time.  Data brokers collect different related information that can be assembled into a mosaic of demographic information that might include race, religion, national origin, sex, sexual orientation, health conditions (subject to HIPAA), disability, veteran status and other commercially “relevant” criteria.  Big Data thus enables the pinpoint analysis of individual conduct as well as the conduct of individuals according to demographic, geographical, financial, educational and economic variables.

The FTC is looking at issues of the use of insights from Big Data (including credit risk scores, demographic information and other assessments) for illegal purposes.  While the FTC has been clear about potential abuses by financial institutions, the issues apply to all companies using Big Data.

Business executives (and law departments) should be asking how their own practices of collecting, analyzing and using Big Data might be abusive or illegal.

Now is a good time to conduct an internal review of your Big Data strategies.

• What criteria do you use for market segmentation?  Consider how you use any Big Data (or direct customer data) in a manner that might discriminate against certain demographics in pricing, new product availability, service priority, credit card lines of credit, retirement account services, financial services, volume discounts, “early bird” or “favored customer” sales.

• What criteria do you use for making preferential offers?  Do you limit access to “unfavored” customers in terms of access to higher quality products, services or content?

• What policies do you have that might create (intentionally or not) a “disparate impact” (which, under one theory of law enformceemnt, constitutes intentional wrongful discrimination)?

• Have you integrated your Big Data initiatives with your corporate social responsibility (CSR) and governance, risk management and compliance (GRC) programs.

Could an International Trade War on Privacy Rights for Online Businesses be Heating Up?

Privacy and data protection are synonymous with the “good life” of e-commerce, when online businesses are free to use consumer data with little restrictions.  But with technological advances and the explosive growth of e-commerce, this area invites extraterritorial regulation by foreign governments across borders.  I’m concerned that this web of web regulations will be totally inconsistent, unmanageable and lead to significant costs and lost opportunities for e-businesses.  Consumer protection should not become a mandate for imposing bureaucracy and “free” content management services.

EU Harmony.  In January 2012, the EU announced proposed reforms to its 1995 data protection rules in order to further strengthen online privacy rights and regulate the enormous growth of data collection and processing over the internet in this age of mobile and social computing, the Internet of Things, Big Data and related analytics.  In short, these reforms proposed:

• a single set of rules to apply across the EU and its administration by a single national data authority within the home EU country with the power to impose fines for non-compliance. 
• In addition, EU people will have greater privacy rights, including the “right to be forgotten” and the “right to port their data” across service providers. 
• EU rules would apply in cross-border transactions for companies in non-EU countries handling services to EU citizens.  Any serious data breaches would have to be reported to authorities as soon as feasible within 24 hours.  Additional costs would be incurred by businesses.

Since then, some EU member nations, major tech companies and other countries have criticized the proposal as being too restrictive and a burdensome expense for (especially small) companies..  Nevertheless, the EU continues to move forward with an amended draft likely to happen later this year with the objective of implementing a Regulation governing its member nations in 2014.

American Federalism:  A Hodge Podge.   In contrast, American federal laws (see https://www.cdt.org/privacy/guide/protect/laws.php) are generally weaker than European and other countries’ laws in the field of consumer protection for data privacy and the “private life.”  A year after the Obama administration called for a draft of a consumer privacy bill of rights, none has been completed or made public.  There are no baseline privacy laws protecting consumers. Instead there are sector specific privacy laws and self regulated company privacy policies; consumer privacy laws vary by state (see http://www.ncsl.org/issues-research/telecom/state-laws-related-to-internet-privacy.aspx).  Those who support this hodge podge of laws insist that these methods encourage free commerce and growth of online businesses.

New Balance: International Agreement or International Chaos?   There is no free lunch.  My concern is that privacy laws will be so onerous, complex and confusing that it will balkanize the Internet, preventing cross-border transactions and increasing the hurdles for Internet entrepreneurship of small and mid-sized businesses.  Consumer protection and data privacy laws will conflict with business, adding costs that will have to be passed along to the consumer in the form of higher prices, more advertising per view, and less innovation.  Should the EU adopt its proposed reforms independently, American companies could find themselves subject to EU regulations when conducting cross-border transactions with EU citizens even if there is no conflict with American laws. 

I believe that every nation should have “baseline” privacy rules, including the US, but I wouldn’t go as far as the proposed EU reforms.   Businesses and/or consumers alike have a:

• Right to know what data is being collected and aggregated about them

• “right to be forgotten” but only where the user pays the cost of undoing what the user posted “for free”
• copyright in posted content and a right to transfer one’s post to other providers, for a reasonable porting fee
• right to know what data is known by a service provider and the right to correct it.

The US and EU are set to begin negotiations for a free trade agreement June 2013.  Hopefully common agreement on data protection and privacy rules will be a part of it.  More on this subject later.