"Pitch Night" - Tips for Innovative Start-ups

“Pitch Night” is the opportunity for startups and innovators to show their business ideas to potential investors/advisors and get feedback on their presentations. I recently attended one in the health IT sector and thought that the critiques presented by these advisors were invaluable advice, not just for this sector, but for anyone interested in exploiting a new e-business idea. I thought I would share some of these key lessons with you today:

1. Who Will Pay for Your Solution? Identify your business opportunity and target market by explaining who is in pain and willing to pay money for your pain-relieving solution.

1. Your pitch should explain:
1. “This is our customer.”
2. “Our customer base is losing money (estimated at $XX per “transaction”/ “event” for YY transactions per year) because of problems we solve. [Describe the problems.]
3. “This is why our customer will gladly pay for our solution to overcome their current chronic problems.”
2. Don’t develop “a tool in search of a problem.”
3. Talk to 100 buyers before you finalize your solution’s design. Understand how they identify their pain and what your solution does and fails to do to resolve that pain.
4. Lawyer’s caution: Be careful. If you explain the “problem that you solve,” you might be explaining the trade secret in your patent application. Think about your “inside voice” (trade secret disclosure under a non-disclsoure agreement) and your “outside, or pitch” voice.

2. Finding the Niche: Steer Away from Obvious Competition. While your solution might have a broad market, you risk losing to deep-pocket competitors who also see a broad market. So target on a niche market where you can acquire a dominating competitive advantage.

1. For large enterprises, third party administrators (TPA’s) already manage large health and wellness programs. They might not see the value of your product.
2. For smaller enterprises, the value of your technological solution might come from the combination of lower per-capital costs of managed services (normally provided by a TPA) where you combine managed administrative services (like a TPA) and the underlying technological solution in a single pricing plan.
3. Identify your “similars”: competitors who have a similar solution, and refine your solution to be different.
4. Explain why you are different and your solution cannot be accessible to your competitors: patents, trade secrets, licensing, governmental monopolies, regulations, first-mover advantage, etc.

3. Prove your Concept. Investors want to know your solution works and is accepted by at least one key “early adopter.” Develop a pilot program to gather performance metrics that demonstrate “proof of concept.”

4. Exploit your Big Data. If your innovative solution collects data (through sensors in the “Internet of Things,” a “tracking” or wearable “monitoring” devices), then develop a plan to own and commercially exploit the value of such Big Data across all your revenue streams.

1. Lawyer’s caution: Before you exploit personally identifiable information (“PII” under data privacy laws) or personal health information (“PHI” under HIPAA), adopt legal procedures for obtaining consents to use it and for securing it from hackers.
2. Design your data collection strategy based on whether it complies with privacy rights. It’s “privacy by design.”

5. Exploiting Mobility; Provide Teleservices. Design your solution for use in telemedicine. If you are selling sensors or other tracking devices and services, identify how your solution overcomes existing problems of distance, such as remote villages lacking world-class medical support, or on the ocean or in the air, or other scenarios where it is predictable that the user will lack access to adequate medical care without your solution.

6. Consider Selling to Channels, not just to Customers. A channel consists of an industry player that regularly supports your target customer’s critical needs. It might be a distributor. But it might also be a strategic buyer who has a gap in its product line and would want to integrate your solution into its solution. Find the gap. Such a strategic buyer might invest in return for some form of preferential distribution rights.

7. Sustainable User Intrigue, not Fatigue. In your sale to users, you cannot merely sell them the product and a six-pack of diagnostic data presentations from the user’s uploading of his/her data to your servers. Over time, the user will become tired because “nothing changes” after the initial use and the initial improvement. To be sustainable, you must design sustainable user demand after the initial “quick success.” Possible solutions:

1. Telemedicine
2. Real-time feedback loop for health improvement (or other benefits) when your solution collects the data from the user
3. “Emergency” alerts, dashboards and “managed care” support
4. Habit-forming disruptive self-service that simplifies life and gives it more meaning with less hassle.

Legal Surprises When You "Like" a Facebook Posting

In a time when online presence defines many of our perceptions, we often think that online comments and postings about an employer would be a big no-no. Think again. A recent decision by the NLRB has given the green light to employees to express themselves freely, even if the employer may see those comments as defamatory.  Employers, beware.

In a recent decision by the National Relations Labor Board in Triple Play Sports Bar & Grille, 361 NLRB No. 31 (August 22, 2014) the NLRB upheld an earlier decision (NLRB 34-CA-01291, January 3, 2012) that the Triple Play Sports Bar & Grille had unlawfully discharged two employees for making disloyal and defamatory posts about their employer in their participation in a Facebook discussion.  In this case, several employees discovered that due to mistakes in their employer’s calculations of their withholding taxes, they would have to pay more taxes and took to their Facebook accounts with their complaints. The recently departed employee posted:

"Maybe someone should do the owners of Triple Play a favor and buy it from them. They can’t even do the tax paperwork correctly!!! Now I OWE money...Wtf!!!!"

In response to this complaint, other employees replied in kind, liked the post and customers of Triple Play commented. The Bar &Grille caught whiff of the thread and terminated two employees for their actions.

Long story made short: the NLRB ruled that the activities of these employees constituted NLR Act, Section 7, protected “concerted activities” for the purpose of employees’ mutual aid and protection and  their right to act together to improve terms and conditions of employment. The ruling found that their discussion related to known tax liabilities in their workplace and issues to be raised in the next staff meeting (ergo, protected and concerted) and that no intended malice or false statements were made by them regarding the products and services of their employer and directed to the public.  This latter was a major contention by the Bar & Grille, which had an Internet/Blogging employment policy prohibiting engaging in “inappropriate discussions about the company, management and/or co-workers.”  This policy was also ruled unlawful in that its employees could perceive these “discussions” to include protected activities in violation of  NLR Act, Section 8 (a)(1), which protects employees’ rights in NLR Act, Section 7, despite the policy’s  “savings” clause, “In the event state or federal law precludes this policy, then it is of no force or effect.”

Lesson to all employers:  Know that certain social media activities are protected by the National Labor Relations Act, particularly when two or more employees act together to improve terms and conditions of employment.  Learn the distinction between employee protected and unprotected social media activities, both in and out of the workplace.  Review your employee policies to ensure compliance with the latest NLRB decisions.

“Airtight” Online “Terms of Use” via Clickwrap or Browsewrap

Do you know the differences between a “clickwrap” agreement and a “browse-wrap” agreement?  If you don’t, you might be unable to enforce your website’s “terms of use.”  In either case, it might be time to redesign your Website’s legal links to ensure they are valid contracts enforceable against your users.

In a recent decision, the U.S. Court of Appeals for the Ninth Circuit upheld an earlier ruling (Nguyen v. Barnes & Noble, Inc., USDC, C.D. California, Aug. 28, 2012) that an online customer at an e-commerce website did not agree to the website’s terms and conditions governing website use and sale of goods, even though there was a conspicuous hyperlink on every page to the website’s “Terms of Use.”   Nguyen v. Barnes & Noble, Inc. (9th Cir. Aug. 18, 2014).  The court held that the user never gave valid binding consent to arbitration or choice of law terms, because (1) the user did not click on the “Terms of Use”, (2) there was “no notice to users” that they were entering into a contract by using the website, and (3) there was no prompt to users to take any affirmative action to demonstrate assent to formation of a contract.  As a result, the website owner was unable to rely upon the Terms of Use, and the consumer was entitled to sue in court for claims arising out of a failed online commercial purchase.

For website users, the decision encourages never clicking on any hyperlinks relating to “terms of use”, “privacy,” “legal conditions” or other hyperlinks customarily posted by website owners.  For website owners, the decision is a wake-up call to immediately change the layout and functioning of the “terms of use,” “legal conditions,” “privacy” and other warnings.

In Nguyen, the court reminded the parties that there are only two flavors of contracts formed on the Internet.

• Under “clickwrap” (or “click-through”) agreements, website users are required to click on an “I agree” box after being presented with a list of terms and conditions of use.
• Under “browse-wrap” agreements, a website’s terms and conditions of use are generally posted on the website via a hyperlink at the bottom of the page, but there is no functionality requiring the user to manifest assent to the terms and conditions expressly.  Because there is no affirmative duty to express such assent, the determination of the validity of the browse-wrap contract depends on whether the user has actual or constructive knowledge of the website’s terms and conditions.  (Such knowledge may be presented on the website or may be given later, in the form of a mailed notice of breach and demand for cure.  Without such knowledge, there is no online contract.

The Nguyen decision did not address whether the website user is deemed to have assented to the website’s privacy policy.   However, the same principles could apply if the user were to argue that she had no actual knowledge of the privacy policy and never assented to the use of cookies, pixel tags, metadata analysis, profiling or other clandestine surveillance, or the re-transfer of personal information to third parties.

To ensure actual consent, the Court warned that “the onus must be on website owners to put users on notice of the terms to which they wish to bind consumers.”  Website owners now must be more “aggressive” or “unfriendly” by giving “actual notice” of the terms and demanding either a clickwrap or a browse-wrap agreement.  “User experience” (“UX”) engineers must now find solutions to keep the website user engaged and in a positive mood, while ensuring that the user is aware of the terms of use and consents to such terms.

One solution involves delaying an “I agree” button (or a display of actual terms of use) until the user is ready to make a purchase or submit information.  But that probably is too late, since the website owner will want to keep any dispute (even as to pre-purchase website usage) out of court and limited to applicable law and a chosen arbitral forum.

Another solution is to force a “pop-up” “I consent” when the user wants to leave the home page.  This could work for privacy matters as well so long as no customer profiling information (from cookies, etc.) were collected at the landing page.  That would require a change in search engine optimization and metatagging customs.  Or “Privacy” might be incorporated into “Terms of Use” to reduce the number of “approval” clicks by users.

A third solution might involve displaying a “Website Terms of Service” button that states “By clicking here, you are indicating that you have read and agree to the Terms of Service.”

The bottom line: “Whether a user has inquiry notice of a browsewrap agreement,  in turn, depends on the design and content of the website and agreement’s webpage.”  Slip opinion, p. 12.  This decision invites everyone to review and perhaps to redesign the legal framework for their online website-based legal agreements.

EU’s Judicial Ruling on “Right to be Forgotten” (Takedown Rights) for Claims by Individuals against Search Engines, and Implications

A recent ruling by the Court of Justice of the European Union (CJEU) has potentially far reaching implications for data privacy in support of an individual’s “right to be forgotten” online both inside and outside the European Union.  Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González (CJEU, May 13, 2014).

It raises serious liability issues for every Internet search engine and international data collection company. To the extent that increased compliance costs will be passed on to advertisers, the opinion increases the cost of doing e-business with EU customers and could increase prices for consumers.

Responsibilities of A Search Engine as a “Data Controller” under EU Privacy Law.  In the case in Spain, which prompted this ruling, a man requested that Google Spain remove the links to old newspaper articles, lawfully published, which were no longer relevant to his situation, but could create a negative impression of him when read.  Google refused, claiming that a search engine creating links to the content of other websites is not the “data controller” but merely an intermediary in relation to third party websites and could neither monitor nor remove this data.

In addition, Google alleged that it was not subject to the 1995 EU Data Protection Directive because its search engine was in the US and it did not have a nexus on EU soil.  Google Spain’s office only sold advertising.

The Spanish court ordered Google to remove the links. Google appealed and the court referred the case to the CJEU for an opinion.  In summary, the CJEU opined:

1) Jurisdiction.   Google was subject to the EU’s jurisdiction because the processing of the data was carried out in the context of the activities of its subsidiary located in Spain and directed at EU member states.

2) Redefinition of “Data Controller.”  Google is indeed a “data controller” because while it just processes the data, even more than third party sources, it controls the dissemination of the data and therefore plays the key role in how such information (already available on other websites) affects the personal privacy and data protection of the individual, making it subject to the EU Directive.

3) Right to be Removed from a Search Engine (sometimes, “the right to be forgotten”). The fundamental rights of the individual to privacy and data protection override the right of Google for economic gain and the right of the public to access this information unless it is in the public interest to do so (as in the case of a public figure).  The individual should be entitled to go to search engines and request that links that were “inadequate, irrelevant or no longer relevant” be removed.

Impact within the EU.
Impact on Search Engines. The decision will reduce the ability of search engines to publish links to personal data of complaining European nationals, will add operating costs for search engines and potentially increase litigation where search engines refuse to “take down” personal data about ordinary citizens.

Impact on EU Data Protection Authorities.   The Google Spain  decision will require each European Data Protection Authority to balance policy factors of free speech versus personal privacy.  This will result in costly, complex and policy-based decisions by administrative bodies, a nightmare for both administrators and litigants.

Impact on Non-EU Web Services Companies.
Jurisdiction.  If you have a “sales subsidiary” in an EU country, your e-commerce operations will now be subject to the full direct application of EU data protection and personal privacy rights, even though your servers, operations and accounts are outside the EU.  The concept of EU judicial jurisdiction over foreign companies in data protection and privacy now looks analogous to broad U.S. federal constitutional limits on judicial jurisdiction, where your “presence” plus your “purposeful availment” of activities in a foreign state will subject you to the jurisdiction of the foreign state under “long arm” statutes.  If there was any doubt, it is now clear that running an e-business globally will subject you to local long-arm jurisdiction on data protection and privacy.  The irony here is that you might be properly outside the taxing jurisdiction (under traditional norms of international jurisdiction within the definition of a “permanent establishment” in tax treaties) while being subject to long-arm jurisdiction for regulatory compliance and privacy torts in a foreign jurisdiction.

Vicarious Liability of the Search Engine as Data Controller without Primary Liability of the Offending Websites whose Sites are Linked by the Search Engine.   One key irony of this decision is that the website publishing the “offensive” “personal data” is not mandated to take down the individual’s “personal data,” but that the search engine that multiplies the number of people who access such content is deemed the “data controller” held liable to honor the “fundamental rights” of the individual.  The ruling imposed vicarious liability for making links but not direct liability for publishing the “private” personal information.

Developing Best Practices for Compliance.   Assuming a search engine accepts a takedown notice as a matter of policy, how can it comply?  How can it be certain that the complaining individual is entitled to a takedown?  If any discretion is involved, it will gum up web commerce.  If no discretion is involved (and one can make new rules that favor takedowns), the technology that allows “opt-outs” and “unsubscribes” can be reconfigured to allow takedown notices.  But the costs of verification of the identity of the affected party will have to be borne by someone, and the decision is one more step towards balkanization of the Internet for free speech and e-commerce.

Impact on US-EU Free Trade.   Privacy law has become a trade barrier of sorts.  The CJEU decision interferes with attempts at harmonization of privacy rights under the pending negotiations for the Transatlantic Trade and Investment Partnership between the US and the EU.  To the extent the Data Protection Directive (1995) and the proposed “General Data Protection Regulation” fail to provide some form of US safe haven (beyond the existing one), the Google Spain decision will likely promote more compartmentalization, less international commerce in data processing services and more localized separate computing environments (e.g., a local “EU Cloud”).

Penalizing the Wrong Business.   The Google Spain decision on data protection and privacy gives preference to privacy rights over freedom of expression.  It punishes the business that links Internet searchers to a validly published Internet website. It adopts a bludgeon against the business that scrapes information from other websites, not the “offending” websites.   The decision punishes the wrong business.

Big Data, Big Abuse Potential

SMAC, n.  (1) a variation of crack-cocaine; (2) a highly addictive, volatile, potentially life-transforming multi-composite drug, sometimes used illegally, universally available in medicine, commerce, education, and family economics; (3) social, mobile, analytics and cloud computing; (4) Big Data.

On April 11, 2014, the U.S. Federal Trade Commission (FTC) announced a public “workshop” on September 15, 2014, to examine effects of Big Data on “low income and underserved consumers.”  The workshop invites comments, reports, and original research to explore current practices in the uses of Big Data on high-income consumers and privacy rights generally.  The FTC will explore concerns that been raised about whether Big Data may be used to categorize consumers in ways that may affect them unfairly, or even unlawfully. (For more info, visit their website.)

The workshop will address consumer protection issues that could result in new regulations or laws affecting virtually all companies (whether or not they are “tech companies):

• How are organizations using Big Data to categorize consumers?

• What benefits do consumers gain from these practices? Do these practices raise consumer protection concerns?

• What benefits do organizations gain from these practices? What are the social and economic impacts, both positive and negative, from the use of Big Data to categorize consumers?

• How do existing laws apply to such practices? Are there gaps in the legal framework?

• Are companies appropriately assessing the impact of big data practices on low income and underserved populations? Should additional measures be considered?

This workshop comes after the FTC examined privacy issues associated with big data practices in its 2012 report Protecting Consumer Privacy In An Era of Rapid Change: Recommendations for Businesses and Policymakers, and its ongoing examination of the data broker industry.

The proliferation of smart phones, tablets, intelligent mobile devices (including wristbands, headphones, automobiles and wearable telecom devices) and online social media have enabled the collection and analysis of huge datapoints.   The Internet of Things will include sensors (some of which are mobile) that are collecting data streams in real time.  Data brokers collect different related information that can be assembled into a mosaic of demographic information that might include race, religion, national origin, sex, sexual orientation, health conditions (subject to HIPAA), disability, veteran status and other commercially “relevant” criteria.  Big Data thus enables the pinpoint analysis of individual conduct as well as the conduct of individuals according to demographic, geographical, financial, educational and economic variables.

The FTC is looking at issues of the use of insights from Big Data (including credit risk scores, demographic information and other assessments) for illegal purposes.  While the FTC has been clear about potential abuses by financial institutions, the issues apply to all companies using Big Data.

Business executives (and law departments) should be asking how their own practices of collecting, analyzing and using Big Data might be abusive or illegal.

Now is a good time to conduct an internal review of your Big Data strategies.

• What criteria do you use for market segmentation?  Consider how you use any Big Data (or direct customer data) in a manner that might discriminate against certain demographics in pricing, new product availability, service priority, credit card lines of credit, retirement account services, financial services, volume discounts, “early bird” or “favored customer” sales.

• What criteria do you use for making preferential offers?  Do you limit access to “unfavored” customers in terms of access to higher quality products, services or content?

• What policies do you have that might create (intentionally or not) a “disparate impact” (which, under one theory of law enformceemnt, constitutes intentional wrongful discrimination)?

• Have you integrated your Big Data initiatives with your corporate social responsibility (CSR) and governance, risk management and compliance (GRC) programs.