Risk Management and Resiliency Planning (Privacy Alert) a Year on First Anniversary of GDPR (and six months before the California Consumer Privacy Act (“CCPA”) becomes effective)

One year after the European Union's General Data Protection Regulation (“GDPR”) effective date of May 25, 2018, two years after GDPR was adopted as EU law, can we hope that the GDPR will just go away? No, that’s wishful thinking. As of February 2019, 59,000 GDPR violations had been reported, with only about 71 enforcement actions. According to several surveys, less than 50% of American businesses are GDPR compliant.

Any implied “grace period” for non-compliance is rapidly coming to an end. You are entering the twilight zone of intentional or grossly negligent non-compliance with GDPR if you are a closely-held businesses with cross-border operations, any global digital business, digital media service provider, a website collecting user information, social media marketers, mailing-list managers (whether using customer relationship management (CRM) software or Outlook or Gmail), anyone uploading data to a “war room” (virtual data room (VDR)).

How do you get really started? It’s time for data mapping, IT risk assessment and mitigation plans, corporate risk management and resiliency plans, especially for privately owned companies such as startups, family-owned business, professional service providers (such as law firms, accounting firms, consultants and financial advisors).

Hidden Risks from Hiding (or Making False Promises that You are Compliant). By when you really need to be fully compliant? Escapism and non-compliance will work for those with short lists of customers, colleagues, foreign friends and low revenues. For those with more than a half million in revenues, you need to be compliant as soon as possible. But SMB’s need to think about special reasons for immediate compliance:

• Lenders. Bank lenders want to maintain your value as an ongoing business, both to demonstrate their own prudent (regulated) lending practices and to prevent a loss of value (such as fines or reputational damage) that might impair “loan-to-value” ratios. You might not be able to get bank financing (or any financing at all) if you cannot represent and warrant that you are in regulatory compliance, with particular reference to privacy laws.
• Investors. Business angels, venture capitalists and private equity investors will want the same assurances, since the value of their equity investment (and opportunity for an eventual exit by M&A) will decline.
• Co-Shareholders. If you are a member of the Board of Directors of a corporation (or manager of a normal LLC), you have a fiduciary duty to be prudent.
• Global Enterprise Customers. Global enterprises that are your customers and clients are already including “flow-down” mandates in their Master Services Agreements (MSA’s) and requirements for Requests for Proposals (RFP). Some might allow no change in your legal obligations until the expiration of your existing contracts. But if your MSA requires you to generally comply with all applicable laws, your enterprise customer will likely be entitled to cancel your deal unless you provide new assurances…including the right of the customer to audit your security and confidentiality covenants.
• Loss of Clientele of Publicly Traded Clients and Customers. Under federal securities laws, a publicly-traded company that neglects its legal obligations under GDPR is subject to fines for false or fraudulent disclosures. Whenever a public company’s stock price drops rapidly due to some surprise to investors, the class action litigators file a lawsuit for punitive damages due to breach of fiduciary duty. The directors of public companies thus have no choice but to adopt GDPR compliance and enforce it throughout their global supply chains.
• Valuation for Sale, Change of Control or Family “Transmission” (Estate Planning). If you are transferring your business in a sale, or inheritance context, you might consider non-compliance as a valuation risk. In valuation of private companies, a discount should apply for known risks of non-compliance with rules that could have a material adverse impact. “Uncertainty as to the stability or continuity of the future income from a property decreases its value by increasing the risk of loss of earnings and value in the future.” IRS Revenue Ruling 59-50, 1959-1 CB 237. The valuation discount become dramatic when one considers the potential impact of an actual security breach, data breach notification costs, indemnification of users, a year’s free access to reputation management services for each affected EU user.
• Financial Audit. Financial auditors have begun asking questions about privacy compliance because the auditor’s role is to identify material risks to your company’s viability. A qualified financial auditor’s opinion may constitute a breach of covenant under your revolving credit loan. It might trigger an event of default under a commercial, financial, investment or other transactional documents.
• Reputational Risks. A data security breach puts your reputation at risk. You might lose clients, employees or existing or prospective business partners. Further, restoring your reputation will be difficult, costly and potentially impossible. Even if you have strong cybersecurity, you should manage the risk by planning your message, your notifications and your story before the breach.
• Vicarious Liability for Defaults of Your Suppliers. Like the EU’s 1995 Data Protection Directive, GDPR makes you liable for the personal data breaches of your suppliers at any level of your supply chain. The CCPA does the same.
• False Advertising. Under the Federal Trade Commission’s rule on false advertising, if you advertise anything about privacy and it’s not true, that’s a violation of federal law.

How can I get compliant? You must change your perspective and re-think your attitude. The GDPR calls for “privacy by design.” Rethink your entire business operations for digital compliance (and, later, for digital services taxation in cross-border and U.S. interstate services). If you receive personal information about European residents, you must comply, or at least have a plan for compliance that is credible for purposes of mitigating damages.

• Data Mapping. First, you need to know your data flows and where your data is stored. If you already know your sources and uses of funds in your accounting statements, you can understand the sources and uses of private data as well as its full life cycle of collection, processing, storage, end of useful life and destruction. 
• Informed and Updated Consents of Users. Update your terms of use and privacy conditions. Data Management. Adopt and implement policies for managing personal data, for “privacy by design” and implementation. Do you need to receive personal data? If you receive IP addresses, will that constitute “personal data” under the circumstances? Can you operate using some form of anonymization?
• Data Security. Security starts at home and ends with your suppliers at all levels.
• Data Transfers. Sharing of personal data with others is a risk.
• Corporate Governance: Policy Adoption and Enforcement. Privacy compliance is for Board review and action. They can be held responsible for breaches.
• IT Governance. Every IT contract needs a privacy clause.
• Procurement Governance. Every procurement contract needs a privacy clause.
• Training. Every employee should be trained not only on cyber-security, but also on legal compliance obligations.
• Audit and Certification. For credibility, it’s advisable to conduct privacy audits. They will help identify weaknesses and can lead to certification, thus preserving customer confidence. As with financial auditing, the individuals responsible for compliance should not be auditing the systems and procedure they have designed and implemented.
• Disaster Recovery Plan / Business Continuity Plan. Such plans are expected in any supply chain. So be ready.

In conclusion, the first anniversary of GDPR marks perhaps the end of any implied grace period, or period of ramp-up of enforcement capabilities of the EU’s data protection agencies.

When Disaster Strikes: 10 Key Steps to Protect Yourself in a Business Divorce

As equity owner, you operate a business entity or department, as partner, manager, managing member, director, officer, etc.   When your business “partners” have gone “hostile” or, as a result of this hostility, have expelled you from the legal entity that operates your business, you should consider taking several immediate steps for your own self-protection.

1.    Segregate your fiduciary role from your personal role.   Out of habit, you might want to assert your continuing rights in your fiduciary role.  You want your voice to be heard and heeded.  Yet, by acting to assert your fiduciary role, you expose yourself to claims of self-dealing, breach of duty of loyalty and intentional damage to shared rights.  Thereby, your personal interests may suffer due to possible conflicts between personal rights and fiduciary duties.  So, resigning your fiduciary role should normally eliminate a conflict and free you to pursue personal goals from the outside.  You might enjoy an advantage in reconnecting personally with clients (if you are not subject to a non-compete covenant) or regrouping with certain employees (if you don’t have a non-solicit covenant).  If you have the freedom to do so, you could become the new professional advisor, “business partner” or even a new part-time employee of a key client, giving you not only cash flow but other benefits as well.

2.    Clearly identify friends and foes.  Establish criteria for segregating friends and foes. And then consider pursuing new alliances if that’s feasible. This will help map a plan with friends through joint strategy and shared resources with the ability to potentially receive common advice from professional advisors supporting all of your “friends” as a group (if that’s what you want) and avoid fruitless delays of pursuing “blind alley” discussions with your foes.

3.    Be honest with yourself about mistakes made by yourself as well as others.  This is a learning opportunity before you leap into the same scenario again.  What values were in conflict (money, power, control, domination, transparency)?  What personality types crossed your wires (micromanagers or project managers working under a plan, budget, goals and deadlines)?

4.    Prioritize to protect your mental and physical health.  Yes, litigation is a tool to assert rights and obtain the remedies of justice.  But, as Ambrose Bierce said in his “Devil’s Dictionary,” a litigant is one who freely gives up his shirt in the hope of saving his skin, while litigation is a machine where enter as a pig and exit as a sausage.  Consider alternative dispute resolution, such as ad hoc arbitration and mediation. Even a partial agreement on certain elements of business separation can limit the harsh personal impact of ongoing disputes.

5.    Hire professional advisors, not only to fight, but also to settle and restructure.  Understand that a litigator might have a financial incentive to continue the formal dispute whereas a conciliator might focus on limiting financial/public damage to all parties involved in bargaining for a quick resolution.  In a stressful conflict environment, the insights of professional advisors can help you see clearly to conflict resolution and eventual creation of new opportunities for self-renewal.  An advisor can help define your future goals and keep you on track.

6.    Deal responsibly with failing partners before expelling them.  When a partner is not achieving common goals or acting selfishly, consider giving her or him a deadline for corrective action.  For example, your enterprise might have taken some growth initiatives that continue to require capital contributions by partners or owners who will not be getting the benefit of the future anticipated growth.  All they do now is subsidize the growth partners who are building their business.  In such cases, rather than give the expectation of perpetual unconditional support, meet with the “growth” partners and search for agreement on interim goals, a future go/ no-go decision for continued support, criteria for continuation vs. separation, and budget for limited future funding of the “growth” opportunity.  If done smartly, the separation of the failing “growth” partners could result in future rewards from future shared business opportunities or even future co-branding.  You could convert a “global partnership” into a “country-by-country partnership” under a global shared brand, with structured incentives for cross-referrals and future collaboration.

7.    Set up a plan and communicate it.  If others disagree, at least you will know what won’t work and who won’t cooperate.  Then redesign the plan.  After multiple iterations, you might achieve consensus.  If not you will understand the framework for litigated dispute resolution.

8.    Get the facts.  Do your own due diligence as if you were buying or selling the company.  (You might have to do one or the other anyway.)  Does the company own all its assets in its own name?  Can some ongoing liabilities be transferred to others, such as by a sublease of rented premises, and if so which third party consents would be required? 

9.    Look for a complete solution (indeed, one that might include potential future collaboration without requiring it).  But plan for partial solutions.  A complete separation agreement has many moving parts and includes both accounting for past mistakes and current assets.  A good solution might also consider a future reward for future mutual benefit, such a non-exclusive software license agreement, a sales commission agreement, and other arrangements that promote collaboration and discourage disparagement, denigration and “unfair” competition.

10.    Address the particular structural issues and governance rules in your organization.   For example, a partnership of lawyers generally face limitations on effective governance since a minority might block the separation agreement, even if the terms are fair to all.  Restructuring is essential at all stages of the organization’s development, so that future scenarios do not torpedo the entire enterprise.  Restructuring promotes joint decision-making and can provide a smooth exit path for those partners who cannot keep up with the new direction of the majority in interest.  Such scenarios may include rapid growth, investment in new technologies, death, resignation or incompetency of a partner or group of partners or the loss of key clients.  Partnership and shareholder agreements should be updated every five or ten years.  By being explicit about governance rules, all partners can feel confident of the future direction, their opportunities to share in future rewards and understand a transparent framework for compliance not only with legal mandates but also the organization’s evolving spirit.

Above all, in a potential business divorce, it is important to maintain clear communication channels, seek professional advice on strategies and tactics and find resolutions which will work not only for you but for your partners as well.

Brand Management in a Crisis: Protecting Goodwill after Employees are Accused of Illegal Conduct

How should you, as CEO, handle an accusation that your employee(s) engaged in illegal activities?  How can you prepare for a crisis where your company’s goodwill, brand and reputation are publicly attacked?

This question hit home to me when I read the news last week about the bribery scheme involving dozens of parents of students applying to prestigious universities.   Athletic coaches were accused of taking bribes to give admission to students who were not fully qualified for their particular sports.  A response by one of these universities, Yale, showed how to respond to a potentially embarrassing crisis that could threaten goodwill among all constituencies, current and prospective.   The lessons apply to businesses and non-profits as well as educational institutions.

1.    Risk Management and Resiliency Planning.  The Board of directors (or trustees) is responsible for identifying and managing risks that could threaten the enterprise’s value, ability to conduct operations and brand.  Any alleged illegality by employees threatens the organization under the legal doctrine of “respondeat superior” as well as loss of brand value.  The entity (as “principal”) is liable for the wrongdoing of its agents.  Under a risk management and resiliency program, management and the team are responsible for anticipating, defining and planning for risky outcomes.  This means scenario analysis, business impact analysis, measuring risk according to severity and probability, adopting insurance and indemnification policies, business continuity planning, disaster recovery planning, corporate governance policies to prevent rogue actions and setting standards of conduct for all employees and contractors.

2.    Prepare an Emergency Response Team.  As with any form of crisis management, effective brand management in a crisis requires governance by a team of individuals, both internal and external to the organization, to investigate, respond, communicate, rectify (if needed) and reconfigure to avoid a repeat of the disaster.   The team should include leaders from different disciplines and points of view. In brand management, this means the Board, the CEO, CFO, Chief risk management officer (if any), Chief Marketing Officer and legal, HR and compliance advisors.   The team must have a pre-designated credible spokesman, who would publicly respond in a manner duly authorized by the board of directors (here, a board of trustees).   In privacy breaches, a similar team might also include the CIO and IT team as well as account managers.  Ideally, the team should have pre-assigned roles and should do “table-top” training exercises in preparation for a real crisis.

3.    Listen to the Press.  In this case, television newscasters were portraying the alleged bribers as “avatars” of abuse by the super-rich, depriving equal opportunity for all applicants.  Being aware of the public policy and slant by the press is essential to a responsive action.

4.    Investigate with Confidentiality and Due Process.  Both internal and external investigators should be engaged.  External investigators lend credibility against suspicions of self-dealing, conflicts of interest by employees or simple incompetence.  External investigators under the supervision of an external lawyer (or law firm) can conduct the investigation under the protection of attorney-client privileged communications and privileged attorney work product.  (Internal lawyers run the risk of not having full “privilege” because some of their functions are managerial or administrative and thus subject them to inquiry as witnesses).  The investigators should show respect for those being interviewed and afford them “due process,” including opportunities to deny, negate claims and present their own side of the story.

5.    Don’t allege misconduct till you have proof.  Meanwhile, demonstrate you are investigating all avenues.  Otherwise, you might accuse an innocent employee and wind up with claims for defamation, invasion of privacy, intentional or negligent infliction of emotional distress, breach of contract, violation of internal policies, civil rights violations, fraud and racketeering (with triple damages claimed).

6.    Act Quickly.   In the era of viral Internet, delays only aggravate suspicions.  Announce early that you are investigating.

7.    Be accessible to your constituents.  Know their interests and address them.

8.    Reaffirm your values.  Identify why the situation violates your values and policies and show you intend to act upon the results of the presently incomplete investigation. Under your corporate governance and human resources management programs, adopt policies against reasonably foreseeable types of misconduct.  Hold your employees to compliance with written standards.  Announce that your investigation is not only about finding guilty parties, but raising the standards by which all employees and contractors are judged.

Investigations and corresponding remedies take time, effort and focus.   Used properly, they can deflect criticism and strengthen the loyalty of your constituencies while avoiding long-lasting impairment of brand value.  Neglected or improperly pursued or reported could prove detrimental to your operations and ultimately brand value. 

Cross-Border M&A under Trump’s “America First” Ideology: No “Terra FIRRMA”

Are you considering acquiring a U.S. company or negotiating an exclusive license for U.S. technology?  Are you looking at any “critical technologies”?

Every foreign investor interested in investing in the U.S. need sit up and take notice of the newly enacted Foreign Investment Risk Review Modernization Act ("FIRRMA"), part of the John S. McCain National Defense Authorization Act (NDAA) recently signed into law by President Trump on August 13, 2018.  FIRRMA expands the role and responsibilities of the Committee on Foreign Investment in the United States ("CFIUS"), an inter-agency Committee, originally established in 1950.  Its charge is to review inbound foreign investment ("covered transactions") in U.S. interstate commerce [specifically, any "merger, acquisition, or takeover…by or with any foreign person" or with a foreign government or foreign government controlled entity] which may potentially affect the national security of the United States and to block or enforce any agreement or condition to mitigate any such threats to national security.  FIRRMA adds "teeth" to how CFIUS can review potential investments which in the past have been outside its jurisdiction and to more effectively provide timely reviews of submissions.

FIRRMA's key provisions were adopted in response to growing foreign investments,   particularly from China, in real estate acquisitions in sensitive areas and in U.S. companies which provide access to sensitive information or technologies critical to U.S. security, even if the investment is non-controlling and represents a minority investment.  Other significant changes include an extended timeline for review, short form "declarations" to speed up the review process, mandatory submissions for certain transactions and initiation of filing fees and funding for CFIUS.

While some changes will take effect immediately, many changes will not take effect until CFIUS prescribes their implementing regulations.  Current regulations are in force until CFIUS provides guidance on the specifics of the new regulations, which is the earlier of either 18 months of the date of enactment or the date that is 30 days after publication in the Federal Register after a determination that the regulations, organizational structure, personnel, and other resources necessary to administer the new provisions are in place.

However, in this new environment, foreign businesses and their legal advisors need to understand the emerging U.S. framework for national security and economic impact review, with a new, expanded bureaucratic role for CFIUS.  These changes will impact due diligence, deal structuring, risk allocation, execution and post-execution deal breakup scenarios. 

"Covered Transactions."   Covered transactions have been expanded to include:
a. Any merger, acquisition or takeover carried out through a joint venture;
b. U.S. real estate purchases, leases or concessions by a foreign person:

1. "Located within or will function as part of, an air or maritime port;"
2. In close proximity to a U.S. military installation, government facility/property that is sensitive for reasons relating to national security, such as at risk of foreign surveillance of national security activities or collection of intelligence on activities being conducted at the facility/property.

Furthermore, subject to CFIUS review now, is:
a. any change in the rights of a foreign person if that change results in control of a U.S. business;
b. any "other investment" by a foreign person in any unaffiliated U.S. business, that:

1. Owns, operates, manufactures, supplies, or services critical infrastructure;
2. Produces, designs, tests, manufactures, fabricates or develops one or more critical technologies;
3. Maintains or collects sensitive personal data of U.S. citizens that may be exploited in a manner that threatens national security.

"Other investment" is further defined as direct or indirect by a foreign person in a U.S. business that affords the person access to any material nonpublic (not in the public domain) technical information relevant to critical infrastructure or critical technologies or membership or observer rights on the board of directors or any other decision-making rights in these U.S. businesses.

However, FIRRMA gives CFIUS the ability to limit the scope of these type of non-controlling passive investments.  Some waivers and exemptions exclude the financial information of a U.S. business' performance, indirect other investment in funds where the fund is managed by the general partner, managing member or equivalent and is not a foreign person or where the foreign person does not have the ability to control the fund or has access to any material nonpublic technical information.

By adding "other investment," FIRRMA appears to be more likely to capture small investments which may have escaped prior notice.

While broad in scope, it is still incumbent on CFIUS to prescribe regulations that govern much of the terms, such as "foreign person" and to "enumerate specific types and examples of such critical infrastructure." Critical technologies also includes "emerging and foundational technologies," as yet to be defined in section 1758 of the "Export Control Reform Act (ECRA) of 2018," another part of the NDAA.

Non-Declared Transactions.  FIRMMA authorizes CFIUS to establish a process to identify covered transactions for which a notice or declaration was not submitted..

Extended Timelines.  Effective immediately, CFIUS' initial review period for written notices is extended from 30 to 45 days and its subsequent investigation period of 30 days can be extended by 15 days in "extraordinary circumstances."  However, it also mandates comments from CFIUS to all parties within 10 days of a draft or written notice, enabling parties to respond on a more timely basis. In the past, CFIUS had no such requirement.

"Declaration" Filings.  Certain transactions may be submitted to CFIUS by one party as a declaration with basic information, not to exceed 5 pages in length (instead of a written notice), which could result in shorter review times since CFIUS must respond to such declarations within 30 days.   It may request a written notice for review, initiate a unilateral review and approve the transaction.

Mandatory Declarations.  In the past, written notices to CFIUS were voluntary, although CFIUS had the power to compel parties to file a written notice for review.  Now, certain covered transactions are mandatory declarations.  These involve a foreign person's investment that results in a substantial interest in a U.S. business by a foreign government or any investment by a foreign person in a U.S. business that develops one or more critical technologies.  If CFIUS determines that the foreign person demonstrates that the investments of the foreign person are not directed by a foreign government and the foreign person has a history of cooperation with the Committee, it may waive review.

Filings Fees and Funding and Staffing.  FIRMMA requires dedicated CFIUS staffing and allows agencies to appoint new staff.  Its initial budget is $20,000,000 to perform the functions of CFIUS.  In addition for the first time, it institutes filing fees for written notices (not declarations) and sets limits on these fees.  However, it leaves the implementing regulations for prescribing these fees and procedures for CFIUS to define.

Remedies.  Expanded choices include:  suspension of the covered transaction while under review or investigation; referral to the President for a decision at any time; or negotiate, impose, enforce any agreement or condition with any party to a completed covered transaction to mitigate any interim risk after a risk based analysis.  Any agreements or conditions are to be effectuated in a compliance plan, that must be monitored for adherence and kept updated.  If non-compliant, the CFIUS may impose penalties, injunctive relief or negotiate a plan to remediate the lack of compliance.

Reporting Requirements.  FIRRMA significantly increases the number of reports to be made to Congress, including a much more detailed review of all covered transactions completed, especially monitoring and compliance plans, as well as all declarations.  Other reports include  Chinese investment in the U.S. (every 2 years), how it compares to the Made in China 2025 plan and any difficulties in collection of the data, the national security risks of foreign state-owned or controlled entities in the manufacture or assembly of rail systems in the U.S. and a briefing on transactions reviewed by CFIUS in the past 5 years which would have allowed foreign persons to inappropriately influence democratic institutions and processes within the United States and in other countries; and the disposition of such reviews.

Planning for Cross-Border Investment and Exclusive Licensing Deals.  Corporate counsel should manage several issues when engaged in cross-border transactions under these new regulations.

Plan.  Planned transactions should include a pre-negotiation analysis of the suitability of the deal under CFIUS.  Management needs to understand national security vulnerabilities and threat factors, SOE risk analysis, transparency, and disclosures by the acquirer and the costs, risks, and contractual allocation of risks in case the deal is blocked.

Understand Timing Expectations.  The parties should expect delays of up to four months (the maximum timeline for CFIUS reviews and referral to the President is 105 days), yet be able to respond to CFIUS information requests in three days, regardless of languages and time zones. Sensitivity to delays should be managed. If either buyer or seller is a publicly-traded company, investors will need to be informed under applicable securities disclosure laws. 

Manage Foreign Financing Risks.  Foreign buyers subject to foreign exchange control must ensure the timing of CFIUS review does not kill the financing.  They must also account for the advent of filing fees to be added to their budgets.

Manage CFIUS-Based Risks.   The parties should identify and manage the impact of CFIUS delays, mitigation and outright denials. Contractually, such risks should be defined and allocated to the foreign buyer in an enforceable manner.  Sellers might insist on a reverse-breakup fee if CFIUS blocks the deal.  To secure payment, an escrow could be imposed.  To secure CFIUS consent, before negotiating any definitive agreement, the parties should negotiate conditions under which buyer would accept CFIUS-imposed mitigations to clear the transaction.

Conclusions
Investors and business alike interested in cross-border deals should continue to monitor the development and implementation of the new regulations by CFIUS.  FIRRMA enables CFIUS to more effectively and efficiently address national security concerns with foreign investment once it finishes its rulemaking process which should provide greater transparency and predictability for investors and businesses as they design their global strategies.  It also provides the opportunity to work more closely with foreign investors in countries allied with the U.S. as its new declarations notices allow CFIUS to expedite reviews, thus reducing time and cost in closing these cases. 


CFIUS operates pursuant to section 721 of the Defense Production Act of 1950, as amended (section 721), and as implemented by Executive Order 11858, as amended, and regulations at 31 C.F.R. Part 800.  https://home.treasury.gov/policy-issues/international/the-committee-on-foreign-investment-in-the-united-states-cfius

FIRRMA, https://home.treasury.gov/sites/default/files/2018-08/The-Foreign-Investment-Risk-Review-Modernization-Act-of-2018-FIRRMA_0.pdf

Comparing GDPR "Privacy by Design" and California Consumer Privacy Act of 2018

Most business people know that data protection, cybersecurity, “safe” profiling and ethical marketing are compliance obligations under the European Union’s General Data Protection Regulation (effective May 25, 2018, the “GDPR”). Echoing the GDPR, on June 28, 2018, effective January 1, 2020, California’s Consumer Privacy Act of 2018 ("CCPA") adopted substantially the same protections for California residents as GDPR does for EU (and EEA) residents. This article compares the EU’s GDPR and the California Consumer Privacy Act and offers some focus for business strategies.

Hidden Profiling. Both GDPR and CCPA focus on unauthorized “profiling” of consumer information that would enable online marketers, using metadata collected without the individual’s knowledge or consent, to draw conclusions about a consumer’s purchasing habits and preferences. The CCPA attacks unauthorized profiling for drawing inferences on “the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligences, abilities and aptitudes.” Sounds like Marketing Segmentation 101.

Privacy Policies. Both GDPR and CCPA require privacy policies and procedures to give an individual notice about the categories of personal information being collected, the categories of sources, the business or commercial purposes for collection or use and the categories of third parties with whom personal data are shared or sold. Both require “informed consent” (or other justified need). Given the similarities, your privacy practices and corresponding privacy policies can probably be “synchronized” to meet the goals of both California Consumer Privacy Act and the General Data Protection Regulation.

Rights of the Individual. Both GDPR and CCPA give the individual the right to access, correct and even request the deletion of personal data, and to receive their personal information in “portable” data formats. Both permit website operators to refuse to delete data where necessary to fulfill a contract and for compliance with law enforcement. GDPR permits retention for “legitimate interests” of the data controller or data process. The CCPA permits retention “to enable solely internal uses [by the data controller or processor] that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.” Both exceptions leave a lot of wiggle room for legal interpretations and litigation.

Enforcement. Each law creates legal rights for individuals whose personal information has been collected, processed or stored without consent (or other “legitimate” purpose). Such rights can be enforced individually or by class action, so the larger the class, the higher the cost. Each permits government officials to sue on behalf of an injured class of consumers. The GDPR permits imposition of fines up to 4% of the worldwide revenues of affiliated groups. The CCPA specifies minimum penalties of at least $100 (up to $750, or greater, for actual damages) per violation per individual. Given the U.S. Supreme Court’s June 21, 2018 Wayfair decision (allowing states to impose sales taxes on out-of-state Internet sales, as a reasonable and non-discriminatory burden on interstate commerce, , the extraterritorial application of California and EU laws will likely be enforceable as a matter of U.S. constitutional law, too.

          Differences between California Consumer Privacy Act and EU General Data Protection Regulation. Discrimination. The California Consumer Privacy Act of 2018 has several features that differ from the GDPR:

• Who Must Comply. The GDPR applies to any personal data of any resident of the European Union and the European Economic Area that are processed outside such zones. The CCPA applies to data collectors that meet one of three conditions: (1) gross annual revenues of $25 million, (2) collects, shares or sells personal information from 50,000 or more persons per year, or (3) derives 50% or more of annual revenues from “selling” (sharing) consumers’ personal information. Thus, California law applies to any mid-market enterprise, one with CRM data on over 50,000 people or any search-engine optimization digital media business.


• No Discrimination against Individuals Asserting Privacy Rights. California grants a right to California residents to equal service and price, even if they exercise their privacy rights (for example, by refusing to trade their personal information for a sweepstakes entry or free limited subscription). Online marketers cannot charge “different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.” Nor can online marketers “provide a different level or quality of goods or services to the consumer, if the consumer exercise the consumer’s rights” to privacy. But a business may offer a different price, rate, level or quality of goods or services if the price or other difference is “directly related to the value provided to the consumer by the consumer’s data.” So this invites price discrimination on the basis of a consumer’s income level or net worth.


• No Vicarious Liability of Data Controller for Breach of Privacy by Data Processor. While the GDPR requires data controllers (who collect personal information) to impose “data processing agreements” on data processors, the California Consumer Protection Act does not. Instead, the CCPA holds the data controller liable only if it is aware of the data processor’s breach of privacy and does nothing to stop it.

          Actions to Limit Potential Liability. Business managers can avoid liability for privacy breaches by making a small investment in privacy design, policy, procedures and emergency management planning.

• Your New “Customer Relationship Management”: Personal Attention, not Just CRM. Your website privacy policy (and terms and conditions of use) should be revised to align your business model with privacy laws. You can get more credibility, customer loyalty and greater legal protection if you carefully disclose, and obtain individual “informed consent” to your stated business purposes, intended uses and possible future disclosures as to all personal information. This transparency is especially important under the California Consumer Privacy Act because its definition of “personal information” is exceptionally broad. Transparency is likewise essential to avoid Federal Trade Commission claims of deceptive practices.


• Business Model Review. The GDPR and CCPA, and new laws likely to be adopted by U.S. federal and state legislators, require all business owners, marketing departments and sales managers to review their business models. “Digital transformation” of the business from Main Street to Internet, and Search engine optimization and social media tools generate huge data sets. Your business model should be based on disclosing your value proposition and inducing your clientele to place trust in the legitimacy of your uses of their personal information and your value proposition. You should give great attention to why there is some value for both you and the customer for doing business with you. If you follow the California model, you can redesign your business to offer financial incentives for collection of personal information.


• Managing your Data Supply Chain and Value Chain: Updating Your Data Processing Agreements. It’s time to re-examine the ecosystem in which you collect and process, directly or through outsourced service providers, personal data and transactions with customers.
• Maybe you should localize in Europe your data processing for European residents.
• Or you might focus on trusted data processors who adopt the U.S. “Privacy Shield” self-certification program that is enforced by the U.S. Department of Commerce in support of the EU’s GDPR.
• Or you might just rely upon your service provider’s contractual assurance not to use or disclose the personal information other than for the contractual processing requirements.
• Or adopt the “model clauses” under the EU’s data protection regime.


• Using “Good” Technology to Defeat “Bad” Technology. Encryption, pseudonymization, de-personalization technologies can relieve the stress of possible privacy violations. If you have the right tools, compliance should be easier, and your business owners might relax more.

In short, it’s time to rethink your relationship with your customer and the impact of these privacy laws on your business model and your business operations. Having done this process for our clients, I have found this a rewarding opportunity for compliance functions to support marketing functions.