As equity owner, you operate a business entity or department, as partner, manager, managing member, director, officer, etc. When your business “partners” have gone “hostile” or, as a result of this hostility, have expelled you from the legal entity that operates your business, you should consider taking several immediate steps for your own self-protection.
1. Segregate your fiduciary role from your personal role. Out of habit, you might want to assert your continuing rights in your fiduciary role. You want your voice to be heard and heeded. Yet, by acting to assert your fiduciary role, you expose yourself to claims of self-dealing, breach of duty of loyalty and intentional damage to shared rights. Thereby, your personal interests may suffer due to possible conflicts between personal rights and fiduciary duties. So, resigning your fiduciary role should normally eliminate a conflict and free you to pursue personal goals from the outside. You might enjoy an advantage in reconnecting personally with clients (if you are not subject to a non-compete covenant) or regrouping with certain employees (if you don’t have a non-solicit covenant). If you have the freedom to do so, you could become the new professional advisor, “business partner” or even a new part-time employee of a key client, giving you not only cash flow but other benefits as well.
2. Clearly identify friends and foes. Establish criteria for segregating friends and foes. And then consider pursuing new alliances if that’s feasible. This will help map a plan with friends through joint strategy and shared resources with the ability to potentially receive common advice from professional advisors supporting all of your “friends” as a group (if that’s what you want) and avoid fruitless delays of pursuing “blind alley” discussions with your foes.
3. Be honest with yourself about mistakes made by yourself as well as others. This is a learning opportunity before you leap into the same scenario again. What values were in conflict (money, power, control, domination, transparency)? What personality types crossed your wires (micromanagers or project managers working under a plan, budget, goals and deadlines)?
4. Prioritize to protect your mental and physical health. Yes, litigation is a tool to assert rights and obtain the remedies of justice. But, as Ambrose Bierce said in his “Devil’s Dictionary,” a litigant is one who freely gives up his shirt in the hope of saving his skin, while litigation is a machine where enter as a pig and exit as a sausage. Consider alternative dispute resolution, such as ad hoc arbitration and mediation. Even a partial agreement on certain elements of business separation can limit the harsh personal impact of ongoing disputes.
5. Hire professional advisors, not only to fight, but also to settle and restructure. Understand that a litigator might have a financial incentive to continue the formal dispute whereas a conciliator might focus on limiting financial/public damage to all parties involved in bargaining for a quick resolution. In a stressful conflict environment, the insights of professional advisors can help you see clearly to conflict resolution and eventual creation of new opportunities for self-renewal. An advisor can help define your future goals and keep you on track.
6. Deal responsibly with failing partners before expelling them. When a partner is not achieving common goals or acting selfishly, consider giving her or him a deadline for corrective action. For example, your enterprise might have taken some growth initiatives that continue to require capital contributions by partners or owners who will not be getting the benefit of the future anticipated growth. All they do now is subsidize the growth partners who are building their business. In such cases, rather than give the expectation of perpetual unconditional support, meet with the “growth” partners and search for agreement on interim goals, a future go/ no-go decision for continued support, criteria for continuation vs. separation, and budget for limited future funding of the “growth” opportunity. If done smartly, the separation of the failing “growth” partners could result in future rewards from future shared business opportunities or even future co-branding. You could convert a “global partnership” into a “country-by-country partnership” under a global shared brand, with structured incentives for cross-referrals and future collaboration.
7. Set up a plan and communicate it. If others disagree, at least you will know what won’t work and who won’t cooperate. Then redesign the plan. After multiple iterations, you might achieve consensus. If not you will understand the framework for litigated dispute resolution.
8. Get the facts. Do your own due diligence as if you were buying or selling the company. (You might have to do one or the other anyway.) Does the company own all its assets in its own name? Can some ongoing liabilities be transferred to others, such as by a sublease of rented premises, and if so which third party consents would be required?
9. Look for a complete solution (indeed, one that might include potential future collaboration without requiring it). But plan for partial solutions. A complete separation agreement has many moving parts and includes both accounting for past mistakes and current assets. A good solution might also consider a future reward for future mutual benefit, such a non-exclusive software license agreement, a sales commission agreement, and other arrangements that promote collaboration and discourage disparagement, denigration and “unfair” competition.
10. Address the particular structural issues and governance rules in your organization. For example, a partnership of lawyers generally face limitations on effective governance since a minority might block the separation agreement, even if the terms are fair to all. Restructuring is essential at all stages of the organization’s development, so that future scenarios do not torpedo the entire enterprise. Restructuring promotes joint decision-making and can provide a smooth exit path for those partners who cannot keep up with the new direction of the majority in interest. Such scenarios may include rapid growth, investment in new technologies, death, resignation or incompetency of a partner or group of partners or the loss of key clients. Partnership and shareholder agreements should be updated every five or ten years. By being explicit about governance rules, all partners can feel confident of the future direction, their opportunities to share in future rewards and understand a transparent framework for compliance not only with legal mandates but also the organization’s evolving spirit.
Above all, in a potential business divorce, it is important to maintain clear communication channels, seek professional advice on strategies and tactics and find resolutions which will work not only for you but for your partners as well.
Thursday, April 11, 2019
Thursday, March 21, 2019
Brand Management in a Crisis: Protecting Goodwill after Employees are Accused of Illegal Conduct
How should you, as CEO, handle an accusation that your employee(s) engaged in illegal activities? How can you prepare for a crisis where your company’s goodwill, brand and reputation are publicly attacked?
This question hit home to me when I read the news last week about the bribery scheme involving dozens of parents of students applying to prestigious universities. Athletic coaches were accused of taking bribes to give admission to students who were not fully qualified for their particular sports. A response by one of these universities, Yale, showed how to respond to a potentially embarrassing crisis that could threaten goodwill among all constituencies, current and prospective. The lessons apply to businesses and non-profits as well as educational institutions.
1. Risk Management and Resiliency Planning. The Board of directors (or trustees) is responsible for identifying and managing risks that could threaten the enterprise’s value, ability to conduct operations and brand. Any alleged illegality by employees threatens the organization under the legal doctrine of “respondeat superior” as well as loss of brand value. The entity (as “principal”) is liable for the wrongdoing of its agents. Under a risk management and resiliency program, management and the team are responsible for anticipating, defining and planning for risky outcomes. This means scenario analysis, business impact analysis, measuring risk according to severity and probability, adopting insurance and indemnification policies, business continuity planning, disaster recovery planning, corporate governance policies to prevent rogue actions and setting standards of conduct for all employees and contractors.
2. Prepare an Emergency Response Team. As with any form of crisis management, effective brand management in a crisis requires governance by a team of individuals, both internal and external to the organization, to investigate, respond, communicate, rectify (if needed) and reconfigure to avoid a repeat of the disaster. The team should include leaders from different disciplines and points of view. In brand management, this means the Board, the CEO, CFO, Chief risk management officer (if any), Chief Marketing Officer and legal, HR and compliance advisors. The team must have a pre-designated credible spokesman, who would publicly respond in a manner duly authorized by the board of directors (here, a board of trustees). In privacy breaches, a similar team might also include the CIO and IT team as well as account managers. Ideally, the team should have pre-assigned roles and should do “table-top” training exercises in preparation for a real crisis.
3. Listen to the Press. In this case, television newscasters were portraying the alleged bribers as “avatars” of abuse by the super-rich, depriving equal opportunity for all applicants. Being aware of the public policy and slant by the press is essential to a responsive action.
4. Investigate with Confidentiality and Due Process. Both internal and external investigators should be engaged. External investigators lend credibility against suspicions of self-dealing, conflicts of interest by employees or simple incompetence. External investigators under the supervision of an external lawyer (or law firm) can conduct the investigation under the protection of attorney-client privileged communications and privileged attorney work product. (Internal lawyers run the risk of not having full “privilege” because some of their functions are managerial or administrative and thus subject them to inquiry as witnesses). The investigators should show respect for those being interviewed and afford them “due process,” including opportunities to deny, negate claims and present their own side of the story.
5. Don’t allege misconduct till you have proof. Meanwhile, demonstrate you are investigating all avenues. Otherwise, you might accuse an innocent employee and wind up with claims for defamation, invasion of privacy, intentional or negligent infliction of emotional distress, breach of contract, violation of internal policies, civil rights violations, fraud and racketeering (with triple damages claimed).
6. Act Quickly. In the era of viral Internet, delays only aggravate suspicions. Announce early that you are investigating.
7. Be accessible to your constituents. Know their interests and address them.
8. Reaffirm your values. Identify why the situation violates your values and policies and show you intend to act upon the results of the presently incomplete investigation. Under your corporate governance and human resources management programs, adopt policies against reasonably foreseeable types of misconduct. Hold your employees to compliance with written standards. Announce that your investigation is not only about finding guilty parties, but raising the standards by which all employees and contractors are judged.
Investigations and corresponding remedies take time, effort and focus. Used properly, they can deflect criticism and strengthen the loyalty of your constituencies while avoiding long-lasting impairment of brand value. Neglected or improperly pursued or reported could prove detrimental to your operations and ultimately brand value.
This question hit home to me when I read the news last week about the bribery scheme involving dozens of parents of students applying to prestigious universities. Athletic coaches were accused of taking bribes to give admission to students who were not fully qualified for their particular sports. A response by one of these universities, Yale, showed how to respond to a potentially embarrassing crisis that could threaten goodwill among all constituencies, current and prospective. The lessons apply to businesses and non-profits as well as educational institutions.
1. Risk Management and Resiliency Planning. The Board of directors (or trustees) is responsible for identifying and managing risks that could threaten the enterprise’s value, ability to conduct operations and brand. Any alleged illegality by employees threatens the organization under the legal doctrine of “respondeat superior” as well as loss of brand value. The entity (as “principal”) is liable for the wrongdoing of its agents. Under a risk management and resiliency program, management and the team are responsible for anticipating, defining and planning for risky outcomes. This means scenario analysis, business impact analysis, measuring risk according to severity and probability, adopting insurance and indemnification policies, business continuity planning, disaster recovery planning, corporate governance policies to prevent rogue actions and setting standards of conduct for all employees and contractors.
2. Prepare an Emergency Response Team. As with any form of crisis management, effective brand management in a crisis requires governance by a team of individuals, both internal and external to the organization, to investigate, respond, communicate, rectify (if needed) and reconfigure to avoid a repeat of the disaster. The team should include leaders from different disciplines and points of view. In brand management, this means the Board, the CEO, CFO, Chief risk management officer (if any), Chief Marketing Officer and legal, HR and compliance advisors. The team must have a pre-designated credible spokesman, who would publicly respond in a manner duly authorized by the board of directors (here, a board of trustees). In privacy breaches, a similar team might also include the CIO and IT team as well as account managers. Ideally, the team should have pre-assigned roles and should do “table-top” training exercises in preparation for a real crisis.
3. Listen to the Press. In this case, television newscasters were portraying the alleged bribers as “avatars” of abuse by the super-rich, depriving equal opportunity for all applicants. Being aware of the public policy and slant by the press is essential to a responsive action.
4. Investigate with Confidentiality and Due Process. Both internal and external investigators should be engaged. External investigators lend credibility against suspicions of self-dealing, conflicts of interest by employees or simple incompetence. External investigators under the supervision of an external lawyer (or law firm) can conduct the investigation under the protection of attorney-client privileged communications and privileged attorney work product. (Internal lawyers run the risk of not having full “privilege” because some of their functions are managerial or administrative and thus subject them to inquiry as witnesses). The investigators should show respect for those being interviewed and afford them “due process,” including opportunities to deny, negate claims and present their own side of the story.
5. Don’t allege misconduct till you have proof. Meanwhile, demonstrate you are investigating all avenues. Otherwise, you might accuse an innocent employee and wind up with claims for defamation, invasion of privacy, intentional or negligent infliction of emotional distress, breach of contract, violation of internal policies, civil rights violations, fraud and racketeering (with triple damages claimed).
6. Act Quickly. In the era of viral Internet, delays only aggravate suspicions. Announce early that you are investigating.
7. Be accessible to your constituents. Know their interests and address them.
8. Reaffirm your values. Identify why the situation violates your values and policies and show you intend to act upon the results of the presently incomplete investigation. Under your corporate governance and human resources management programs, adopt policies against reasonably foreseeable types of misconduct. Hold your employees to compliance with written standards. Announce that your investigation is not only about finding guilty parties, but raising the standards by which all employees and contractors are judged.
Investigations and corresponding remedies take time, effort and focus. Used properly, they can deflect criticism and strengthen the loyalty of your constituencies while avoiding long-lasting impairment of brand value. Neglected or improperly pursued or reported could prove detrimental to your operations and ultimately brand value.
Thursday, September 27, 2018
Cross-Border M&A under Trump’s “America First” Ideology: No “Terra FIRRMA”
Are you considering acquiring a U.S. company or negotiating an exclusive license for U.S. technology? Are you looking at any “critical technologies”?
Every foreign investor interested in investing in the U.S. need sit up and take notice of the newly enacted Foreign Investment Risk Review Modernization Act ("FIRRMA"), part of the John S. McCain National Defense Authorization Act (NDAA) recently signed into law by President Trump on August 13, 2018. FIRRMA expands the role and responsibilities of the Committee on Foreign Investment in the United States ("CFIUS"), an inter-agency Committee, originally established in 1950. Its charge is to review inbound foreign investment ("covered transactions") in U.S. interstate commerce [specifically, any "merger, acquisition, or takeover…by or with any foreign person" or with a foreign government or foreign government controlled entity] which may potentially affect the national security of the United States and to block or enforce any agreement or condition to mitigate any such threats to national security. FIRRMA adds "teeth" to how CFIUS can review potential investments which in the past have been outside its jurisdiction and to more effectively provide timely reviews of submissions.
FIRRMA's key provisions were adopted in response to growing foreign investments, particularly from China, in real estate acquisitions in sensitive areas and in U.S. companies which provide access to sensitive information or technologies critical to U.S. security, even if the investment is non-controlling and represents a minority investment. Other significant changes include an extended timeline for review, short form "declarations" to speed up the review process, mandatory submissions for certain transactions and initiation of filing fees and funding for CFIUS.
While some changes will take effect immediately, many changes will not take effect until CFIUS prescribes their implementing regulations. Current regulations are in force until CFIUS provides guidance on the specifics of the new regulations, which is the earlier of either 18 months of the date of enactment or the date that is 30 days after publication in the Federal Register after a determination that the regulations, organizational structure, personnel, and other resources necessary to administer the new provisions are in place.
However, in this new environment, foreign businesses and their legal advisors need to understand the emerging U.S. framework for national security and economic impact review, with a new, expanded bureaucratic role for CFIUS. These changes will impact due diligence, deal structuring, risk allocation, execution and post-execution deal breakup scenarios.
"Covered Transactions." Covered transactions have been expanded to include:
a. Any merger, acquisition or takeover carried out through a joint venture;
b. U.S. real estate purchases, leases or concessions by a foreign person:
a. any change in the rights of a foreign person if that change results in control of a U.S. business;
b. any "other investment" by a foreign person in any unaffiliated U.S. business, that:
However, FIRRMA gives CFIUS the ability to limit the scope of these type of non-controlling passive investments. Some waivers and exemptions exclude the financial information of a U.S. business' performance, indirect other investment in funds where the fund is managed by the general partner, managing member or equivalent and is not a foreign person or where the foreign person does not have the ability to control the fund or has access to any material nonpublic technical information.
By adding "other investment," FIRRMA appears to be more likely to capture small investments which may have escaped prior notice.
While broad in scope, it is still incumbent on CFIUS to prescribe regulations that govern much of the terms, such as "foreign person" and to "enumerate specific types and examples of such critical infrastructure." Critical technologies also includes "emerging and foundational technologies," as yet to be defined in section 1758 of the "Export Control Reform Act (ECRA) of 2018," another part of the NDAA.
Non-Declared Transactions. FIRMMA authorizes CFIUS to establish a process to identify covered transactions for which a notice or declaration was not submitted..
Extended Timelines. Effective immediately, CFIUS' initial review period for written notices is extended from 30 to 45 days and its subsequent investigation period of 30 days can be extended by 15 days in "extraordinary circumstances." However, it also mandates comments from CFIUS to all parties within 10 days of a draft or written notice, enabling parties to respond on a more timely basis. In the past, CFIUS had no such requirement.
"Declaration" Filings. Certain transactions may be submitted to CFIUS by one party as a declaration with basic information, not to exceed 5 pages in length (instead of a written notice), which could result in shorter review times since CFIUS must respond to such declarations within 30 days. It may request a written notice for review, initiate a unilateral review and approve the transaction.
Mandatory Declarations. In the past, written notices to CFIUS were voluntary, although CFIUS had the power to compel parties to file a written notice for review. Now, certain covered transactions are mandatory declarations. These involve a foreign person's investment that results in a substantial interest in a U.S. business by a foreign government or any investment by a foreign person in a U.S. business that develops one or more critical technologies. If CFIUS determines that the foreign person demonstrates that the investments of the foreign person are not directed by a foreign government and the foreign person has a history of cooperation with the Committee, it may waive review.
Filings Fees and Funding and Staffing. FIRMMA requires dedicated CFIUS staffing and allows agencies to appoint new staff. Its initial budget is $20,000,000 to perform the functions of CFIUS. In addition for the first time, it institutes filing fees for written notices (not declarations) and sets limits on these fees. However, it leaves the implementing regulations for prescribing these fees and procedures for CFIUS to define.
Remedies. Expanded choices include: suspension of the covered transaction while under review or investigation; referral to the President for a decision at any time; or negotiate, impose, enforce any agreement or condition with any party to a completed covered transaction to mitigate any interim risk after a risk based analysis. Any agreements or conditions are to be effectuated in a compliance plan, that must be monitored for adherence and kept updated. If non-compliant, the CFIUS may impose penalties, injunctive relief or negotiate a plan to remediate the lack of compliance.
Reporting Requirements. FIRRMA significantly increases the number of reports to be made to Congress, including a much more detailed review of all covered transactions completed, especially monitoring and compliance plans, as well as all declarations. Other reports include Chinese investment in the U.S. (every 2 years), how it compares to the Made in China 2025 plan and any difficulties in collection of the data, the national security risks of foreign state-owned or controlled entities in the manufacture or assembly of rail systems in the U.S. and a briefing on transactions reviewed by CFIUS in the past 5 years which would have allowed foreign persons to inappropriately influence democratic institutions and processes within the United States and in other countries; and the disposition of such reviews.
Planning for Cross-Border Investment and Exclusive Licensing Deals. Corporate counsel should manage several issues when engaged in cross-border transactions under these new regulations.
Plan. Planned transactions should include a pre-negotiation analysis of the suitability of the deal under CFIUS. Management needs to understand national security vulnerabilities and threat factors, SOE risk analysis, transparency, and disclosures by the acquirer and the costs, risks, and contractual allocation of risks in case the deal is blocked.
Understand Timing Expectations. The parties should expect delays of up to four months (the maximum timeline for CFIUS reviews and referral to the President is 105 days), yet be able to respond to CFIUS information requests in three days, regardless of languages and time zones. Sensitivity to delays should be managed. If either buyer or seller is a publicly-traded company, investors will need to be informed under applicable securities disclosure laws.
Manage Foreign Financing Risks. Foreign buyers subject to foreign exchange control must ensure the timing of CFIUS review does not kill the financing. They must also account for the advent of filing fees to be added to their budgets.
Manage CFIUS-Based Risks. The parties should identify and manage the impact of CFIUS delays, mitigation and outright denials. Contractually, such risks should be defined and allocated to the foreign buyer in an enforceable manner. Sellers might insist on a reverse-breakup fee if CFIUS blocks the deal. To secure payment, an escrow could be imposed. To secure CFIUS consent, before negotiating any definitive agreement, the parties should negotiate conditions under which buyer would accept CFIUS-imposed mitigations to clear the transaction.
Conclusions
Investors and business alike interested in cross-border deals should continue to monitor the development and implementation of the new regulations by CFIUS. FIRRMA enables CFIUS to more effectively and efficiently address national security concerns with foreign investment once it finishes its rulemaking process which should provide greater transparency and predictability for investors and businesses as they design their global strategies. It also provides the opportunity to work more closely with foreign investors in countries allied with the U.S. as its new declarations notices allow CFIUS to expedite reviews, thus reducing time and cost in closing these cases.
CFIUS operates pursuant to section 721 of the Defense Production Act of 1950, as amended (section 721), and as implemented by Executive Order 11858, as amended, and regulations at 31 C.F.R. Part 800. https://home.treasury.gov/policy-issues/international/the-committee-on-foreign-investment-in-the-united-states-cfius
FIRRMA, https://home.treasury.gov/sites/default/files/2018-08/The-Foreign-Investment-Risk-Review-Modernization-Act-of-2018-FIRRMA_0.pdf
Every foreign investor interested in investing in the U.S. need sit up and take notice of the newly enacted Foreign Investment Risk Review Modernization Act ("FIRRMA"), part of the John S. McCain National Defense Authorization Act (NDAA) recently signed into law by President Trump on August 13, 2018. FIRRMA expands the role and responsibilities of the Committee on Foreign Investment in the United States ("CFIUS"), an inter-agency Committee, originally established in 1950. Its charge is to review inbound foreign investment ("covered transactions") in U.S. interstate commerce [specifically, any "merger, acquisition, or takeover…by or with any foreign person" or with a foreign government or foreign government controlled entity] which may potentially affect the national security of the United States and to block or enforce any agreement or condition to mitigate any such threats to national security. FIRRMA adds "teeth" to how CFIUS can review potential investments which in the past have been outside its jurisdiction and to more effectively provide timely reviews of submissions.
FIRRMA's key provisions were adopted in response to growing foreign investments, particularly from China, in real estate acquisitions in sensitive areas and in U.S. companies which provide access to sensitive information or technologies critical to U.S. security, even if the investment is non-controlling and represents a minority investment. Other significant changes include an extended timeline for review, short form "declarations" to speed up the review process, mandatory submissions for certain transactions and initiation of filing fees and funding for CFIUS.
While some changes will take effect immediately, many changes will not take effect until CFIUS prescribes their implementing regulations. Current regulations are in force until CFIUS provides guidance on the specifics of the new regulations, which is the earlier of either 18 months of the date of enactment or the date that is 30 days after publication in the Federal Register after a determination that the regulations, organizational structure, personnel, and other resources necessary to administer the new provisions are in place.
However, in this new environment, foreign businesses and their legal advisors need to understand the emerging U.S. framework for national security and economic impact review, with a new, expanded bureaucratic role for CFIUS. These changes will impact due diligence, deal structuring, risk allocation, execution and post-execution deal breakup scenarios.
"Covered Transactions." Covered transactions have been expanded to include:
a. Any merger, acquisition or takeover carried out through a joint venture;
b. U.S. real estate purchases, leases or concessions by a foreign person:
- 1. "Located within or will function as part of, an air or maritime port;"
2. In close proximity to a U.S. military installation, government facility/property that is sensitive for reasons relating to national security, such as at risk of foreign surveillance of national security activities or collection of intelligence on activities being conducted at the facility/property.
a. any change in the rights of a foreign person if that change results in control of a U.S. business;
b. any "other investment" by a foreign person in any unaffiliated U.S. business, that:
- 1. Owns, operates, manufactures, supplies, or services critical infrastructure;
2. Produces, designs, tests, manufactures, fabricates or develops one or more critical technologies;
3. Maintains or collects sensitive personal data of U.S. citizens that may be exploited in a manner that threatens national security.
However, FIRRMA gives CFIUS the ability to limit the scope of these type of non-controlling passive investments. Some waivers and exemptions exclude the financial information of a U.S. business' performance, indirect other investment in funds where the fund is managed by the general partner, managing member or equivalent and is not a foreign person or where the foreign person does not have the ability to control the fund or has access to any material nonpublic technical information.
By adding "other investment," FIRRMA appears to be more likely to capture small investments which may have escaped prior notice.
While broad in scope, it is still incumbent on CFIUS to prescribe regulations that govern much of the terms, such as "foreign person" and to "enumerate specific types and examples of such critical infrastructure." Critical technologies also includes "emerging and foundational technologies," as yet to be defined in section 1758 of the "Export Control Reform Act (ECRA) of 2018," another part of the NDAA.
Non-Declared Transactions. FIRMMA authorizes CFIUS to establish a process to identify covered transactions for which a notice or declaration was not submitted..
Extended Timelines. Effective immediately, CFIUS' initial review period for written notices is extended from 30 to 45 days and its subsequent investigation period of 30 days can be extended by 15 days in "extraordinary circumstances." However, it also mandates comments from CFIUS to all parties within 10 days of a draft or written notice, enabling parties to respond on a more timely basis. In the past, CFIUS had no such requirement.
"Declaration" Filings. Certain transactions may be submitted to CFIUS by one party as a declaration with basic information, not to exceed 5 pages in length (instead of a written notice), which could result in shorter review times since CFIUS must respond to such declarations within 30 days. It may request a written notice for review, initiate a unilateral review and approve the transaction.
Mandatory Declarations. In the past, written notices to CFIUS were voluntary, although CFIUS had the power to compel parties to file a written notice for review. Now, certain covered transactions are mandatory declarations. These involve a foreign person's investment that results in a substantial interest in a U.S. business by a foreign government or any investment by a foreign person in a U.S. business that develops one or more critical technologies. If CFIUS determines that the foreign person demonstrates that the investments of the foreign person are not directed by a foreign government and the foreign person has a history of cooperation with the Committee, it may waive review.
Filings Fees and Funding and Staffing. FIRMMA requires dedicated CFIUS staffing and allows agencies to appoint new staff. Its initial budget is $20,000,000 to perform the functions of CFIUS. In addition for the first time, it institutes filing fees for written notices (not declarations) and sets limits on these fees. However, it leaves the implementing regulations for prescribing these fees and procedures for CFIUS to define.
Remedies. Expanded choices include: suspension of the covered transaction while under review or investigation; referral to the President for a decision at any time; or negotiate, impose, enforce any agreement or condition with any party to a completed covered transaction to mitigate any interim risk after a risk based analysis. Any agreements or conditions are to be effectuated in a compliance plan, that must be monitored for adherence and kept updated. If non-compliant, the CFIUS may impose penalties, injunctive relief or negotiate a plan to remediate the lack of compliance.
Reporting Requirements. FIRRMA significantly increases the number of reports to be made to Congress, including a much more detailed review of all covered transactions completed, especially monitoring and compliance plans, as well as all declarations. Other reports include Chinese investment in the U.S. (every 2 years), how it compares to the Made in China 2025 plan and any difficulties in collection of the data, the national security risks of foreign state-owned or controlled entities in the manufacture or assembly of rail systems in the U.S. and a briefing on transactions reviewed by CFIUS in the past 5 years which would have allowed foreign persons to inappropriately influence democratic institutions and processes within the United States and in other countries; and the disposition of such reviews.
Planning for Cross-Border Investment and Exclusive Licensing Deals. Corporate counsel should manage several issues when engaged in cross-border transactions under these new regulations.
Plan. Planned transactions should include a pre-negotiation analysis of the suitability of the deal under CFIUS. Management needs to understand national security vulnerabilities and threat factors, SOE risk analysis, transparency, and disclosures by the acquirer and the costs, risks, and contractual allocation of risks in case the deal is blocked.
Understand Timing Expectations. The parties should expect delays of up to four months (the maximum timeline for CFIUS reviews and referral to the President is 105 days), yet be able to respond to CFIUS information requests in three days, regardless of languages and time zones. Sensitivity to delays should be managed. If either buyer or seller is a publicly-traded company, investors will need to be informed under applicable securities disclosure laws.
Manage Foreign Financing Risks. Foreign buyers subject to foreign exchange control must ensure the timing of CFIUS review does not kill the financing. They must also account for the advent of filing fees to be added to their budgets.
Manage CFIUS-Based Risks. The parties should identify and manage the impact of CFIUS delays, mitigation and outright denials. Contractually, such risks should be defined and allocated to the foreign buyer in an enforceable manner. Sellers might insist on a reverse-breakup fee if CFIUS blocks the deal. To secure payment, an escrow could be imposed. To secure CFIUS consent, before negotiating any definitive agreement, the parties should negotiate conditions under which buyer would accept CFIUS-imposed mitigations to clear the transaction.
Conclusions
Investors and business alike interested in cross-border deals should continue to monitor the development and implementation of the new regulations by CFIUS. FIRRMA enables CFIUS to more effectively and efficiently address national security concerns with foreign investment once it finishes its rulemaking process which should provide greater transparency and predictability for investors and businesses as they design their global strategies. It also provides the opportunity to work more closely with foreign investors in countries allied with the U.S. as its new declarations notices allow CFIUS to expedite reviews, thus reducing time and cost in closing these cases.
CFIUS operates pursuant to section 721 of the Defense Production Act of 1950, as amended (section 721), and as implemented by Executive Order 11858, as amended, and regulations at 31 C.F.R. Part 800. https://home.treasury.gov/policy-issues/international/the-committee-on-foreign-investment-in-the-united-states-cfius
FIRRMA, https://home.treasury.gov/sites/default/files/2018-08/The-Foreign-Investment-Risk-Review-Modernization-Act-of-2018-FIRRMA_0.pdf
Thursday, July 12, 2018
Comparing GDPR "Privacy by Design" and California Consumer Privacy Act of 2018
Most business people know that data protection, cybersecurity, “safe” profiling and ethical marketing are compliance obligations under the European Union’s General Data Protection Regulation (effective May 25, 2018, the “GDPR”). Echoing the GDPR, on June 28, 2018, effective January 1, 2020, California’s Consumer Privacy Act of 2018 ("CCPA") adopted substantially the same protections for California residents as GDPR does for EU (and EEA) residents. This article compares the EU’s GDPR and the California Consumer Privacy Act and offers some focus for business strategies.
Hidden Profiling. Both GDPR and CCPA focus on unauthorized “profiling” of consumer information that would enable online marketers, using metadata collected without the individual’s knowledge or consent, to draw conclusions about a consumer’s purchasing habits and preferences. The CCPA attacks unauthorized profiling for drawing inferences on “the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligences, abilities and aptitudes.” Sounds like Marketing Segmentation 101.
Privacy Policies. Both GDPR and CCPA require privacy policies and procedures to give an individual notice about the categories of personal information being collected, the categories of sources, the business or commercial purposes for collection or use and the categories of third parties with whom personal data are shared or sold. Both require “informed consent” (or other justified need). Given the similarities, your privacy practices and corresponding privacy policies can probably be “synchronized” to meet the goals of both California Consumer Privacy Act and the General Data Protection Regulation.
Rights of the Individual. Both GDPR and CCPA give the individual the right to access, correct and even request the deletion of personal data, and to receive their personal information in “portable” data formats. Both permit website operators to refuse to delete data where necessary to fulfill a contract and for compliance with law enforcement. GDPR permits retention for “legitimate interests” of the data controller or data process. The CCPA permits retention “to enable solely internal uses [by the data controller or processor] that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.” Both exceptions leave a lot of wiggle room for legal interpretations and litigation.
Enforcement. Each law creates legal rights for individuals whose personal information has been collected, processed or stored without consent (or other “legitimate” purpose). Such rights can be enforced individually or by class action, so the larger the class, the higher the cost. Each permits government officials to sue on behalf of an injured class of consumers. The GDPR permits imposition of fines up to 4% of the worldwide revenues of affiliated groups. The CCPA specifies minimum penalties of at least $100 (up to $750, or greater, for actual damages) per violation per individual. Given the U.S. Supreme Court’s June 21, 2018 Wayfair decision (allowing states to impose sales taxes on out-of-state Internet sales, as a reasonable and non-discriminatory burden on interstate commerce, , the extraterritorial application of California and EU laws will likely be enforceable as a matter of U.S. constitutional law, too.
Differences between California Consumer Privacy Act and EU General Data Protection Regulation. Discrimination. The California Consumer Privacy Act of 2018 has several features that differ from the GDPR:
Hidden Profiling. Both GDPR and CCPA focus on unauthorized “profiling” of consumer information that would enable online marketers, using metadata collected without the individual’s knowledge or consent, to draw conclusions about a consumer’s purchasing habits and preferences. The CCPA attacks unauthorized profiling for drawing inferences on “the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligences, abilities and aptitudes.” Sounds like Marketing Segmentation 101.
Privacy Policies. Both GDPR and CCPA require privacy policies and procedures to give an individual notice about the categories of personal information being collected, the categories of sources, the business or commercial purposes for collection or use and the categories of third parties with whom personal data are shared or sold. Both require “informed consent” (or other justified need). Given the similarities, your privacy practices and corresponding privacy policies can probably be “synchronized” to meet the goals of both California Consumer Privacy Act and the General Data Protection Regulation.
Rights of the Individual. Both GDPR and CCPA give the individual the right to access, correct and even request the deletion of personal data, and to receive their personal information in “portable” data formats. Both permit website operators to refuse to delete data where necessary to fulfill a contract and for compliance with law enforcement. GDPR permits retention for “legitimate interests” of the data controller or data process. The CCPA permits retention “to enable solely internal uses [by the data controller or processor] that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.” Both exceptions leave a lot of wiggle room for legal interpretations and litigation.
Enforcement. Each law creates legal rights for individuals whose personal information has been collected, processed or stored without consent (or other “legitimate” purpose). Such rights can be enforced individually or by class action, so the larger the class, the higher the cost. Each permits government officials to sue on behalf of an injured class of consumers. The GDPR permits imposition of fines up to 4% of the worldwide revenues of affiliated groups. The CCPA specifies minimum penalties of at least $100 (up to $750, or greater, for actual damages) per violation per individual. Given the U.S. Supreme Court’s June 21, 2018 Wayfair decision (allowing states to impose sales taxes on out-of-state Internet sales, as a reasonable and non-discriminatory burden on interstate commerce, , the extraterritorial application of California and EU laws will likely be enforceable as a matter of U.S. constitutional law, too.
Differences between California Consumer Privacy Act and EU General Data Protection Regulation. Discrimination. The California Consumer Privacy Act of 2018 has several features that differ from the GDPR:
- Who Must Comply. The GDPR applies to any personal data of any resident of the European Union and the European Economic Area that are processed outside such zones. The CCPA applies to data collectors that meet one of three conditions: (1) gross annual revenues of $25 million, (2) collects, shares or sells personal information from 50,000 or more persons per year, or (3) derives 50% or more of annual revenues from “selling” (sharing) consumers’ personal information. Thus, California law applies to any mid-market enterprise, one with CRM data on over 50,000 people or any search-engine optimization digital media business.
- No Discrimination against Individuals Asserting Privacy Rights. California grants a right to California residents to equal service and price, even if they exercise their privacy rights (for example, by refusing to trade their personal information for a sweepstakes entry or free limited subscription). Online marketers cannot charge “different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.” Nor can online marketers “provide a different level or quality of goods or services to the consumer, if the consumer exercise the consumer’s rights” to privacy. But a business may offer a different price, rate, level or quality of goods or services if the price or other difference is “directly related to the value provided to the consumer by the consumer’s data.” So this invites price discrimination on the basis of a consumer’s income level or net worth.
- No Vicarious Liability of Data Controller for Breach of Privacy by Data Processor. While the GDPR requires data controllers (who collect personal information) to impose “data processing agreements” on data processors, the California Consumer Protection Act does not. Instead, the CCPA holds the data controller liable only if it is aware of the data processor’s breach of privacy and does nothing to stop it.
- Your New “Customer Relationship Management”: Personal Attention, not Just CRM. Your website privacy policy (and terms and conditions of use) should be revised to align your business model with privacy laws. You can get more credibility, customer loyalty and greater legal protection if you carefully disclose, and obtain individual “informed consent” to your stated business purposes, intended uses and possible future disclosures as to all personal information. This transparency is especially important under the California Consumer Privacy Act because its definition of “personal information” is exceptionally broad. Transparency is likewise essential to avoid Federal Trade Commission claims of deceptive practices.
- Business Model Review. The GDPR and CCPA, and new laws likely to be adopted by U.S. federal and state legislators, require all business owners, marketing departments and sales managers to review their business models. “Digital transformation” of the business from Main Street to Internet, and Search engine optimization and social media tools generate huge data sets. Your business model should be based on disclosing your value proposition and inducing your clientele to place trust in the legitimacy of your uses of their personal information and your value proposition. You should give great attention to why there is some value for both you and the customer for doing business with you. If you follow the California model, you can redesign your business to offer financial incentives for collection of personal information.
- Managing your Data Supply Chain and Value Chain: Updating Your Data Processing Agreements. It’s time to re-examine the ecosystem in which you collect and process, directly or through outsourced service providers, personal data and transactions with customers.
- Maybe you should localize in Europe your data processing for European residents.
- Or you might focus on trusted data processors who adopt the U.S. “Privacy Shield” self-certification program that is enforced by the U.S. Department of Commerce in support of the EU’s GDPR.
- Or you might just rely upon your service provider’s contractual assurance not to use or disclose the personal information other than for the contractual processing requirements.
- Or adopt the “model clauses” under the EU’s data protection regime.
- Using “Good” Technology to Defeat “Bad” Technology. Encryption, pseudonymization, de-personalization technologies can relieve the stress of possible privacy violations. If you have the right tools, compliance should be easier, and your business owners might relax more.
Tuesday, April 3, 2018
Board of Directors’ Governance Duties on Privacy, Compliance and Sexual Harassment: How to avoid “Falling Flat on your Facebook”
Corporate Directors must manage the company for the best in interests of stockholders and, in general, to ensure the company complies with its regulatory and contractual obligations. Today, every company undertakes some digital transformation, using Cloud, social media, mobile devices, Big Data, analytics and potentially virtual reality, augmented reality, robotic process automation and sensor-driven “Internet of Things” like self-driving vehicles and remote controls using mobile devices. But the benefits of digital transformation come with many disruptive risks such as cyber security breaches, privacy violations that will cost serious money under the EU’s General Data Protection Regulation effective May 25, 2018, etc. The scalability of tech “solutions” invites hackers and thieves. At best, the company’s reputation is tarnished.
In a new threatening world, the “business judgment” rule protecting corporate directors and officers from personal liability requires greater vigilance and broader risk management. A corporate director’s personal liability for the misdeeds of the corporation and its employees depends on how well the director planned for and responds to the “inevitable” corporate governance disaster such as:
1. Maintaining Independent Judgment despite Lack of Control Anticipating
It may be impossible to fulfill the directors’ duty of loyalty and to maintain one’s independent judgment if the CEO owns a majority of voting control of the company’s voting shares. That’s the case for Facebook, where Mark Zuckerberg, founder and CEO, owns about 10% of the shares but controls a majority of voting rights. If you displease the CEO, you could get fired from the board of a valuable and prestigious company. If you don’t displease the CEO, you might not have exercised independent judgment. So you need to identify and implement measures that will be best for the company, which could include mandating certain actions by the CEO who is in control of your position as director. And your D&O insurance carrier expects nothing less so as to mitigate any payouts on the inevitable derivative claims by shareholders.
2. Identify Worst Scenarios for Your Particular Business and Your Value Chain
From an insurer’s perspective, risk management requires identification and assessment of risks for probability and adverse impact. The digital economy increases the number and nature of risks.
Public companies must identify their risk profile in their quarterly and annual SEC reports. Private companies must likewise disclose key risks on private placement memoranda, loan applications, and prospective acquirers in shareholder meetings under the principle of shareholder democracy. For Wynn Resorts, an empire built on gambling casinos and flashy entertainment, the risks of sexual predation by the founder, who has access to private suites and private transportation, was predictable to directors who focus on high-probability risk analysis. For Facebook, a director who understands the business model of vacuuming personal data from subscribers and their network of “friends” for resale to “data consolidators” like Cambridge Analytica could predict a failure of accountability in the value chain. At a minimum, all supply chain contracts should guarantee that the corporation’s trusted data and business secrets will be protected and that any governmental mandates (such as privacy protections) applicable to the supplier’s services should flow down to the supplier.
Since worst case scenarios change over time, anticipating how changes in laws, politics and public opinion becomes part of the director’s job too. No one asked, but it’s your duty to worry and plan.
3. Insulate and Compartmentalize Processes; Identify Failure Switches
The Titanic sank because it hit an iceberg at high speed at night. Appropriately, the captain went down with the ship, but so did many hundreds more. The ship was designed to withstand four breached compartments, but not five. The lessons today are, don’t accelerate in risky waters and insulate and compartmentalize to insulate the business operation from cumulative, cascading risks.
For international companies, a private cloud might effectively limit risk. Minimization of cross-border transfers of sensitive personal data can be done by using multiple servers, two in each country (the second is for failover). Insulation can also be achieved by pseudonymization, a new concept advocated by the EU’s GDPR that stops short of full encryption but achieves compliance … until the code is broken.
4. Incentivize Prudent Behaviors by Employees
Wells Fargo made the mistake of incentivizing its bank branch officers to create new accounts not requested by the customers. The IT department and compliance departments were asleep and could have stopped this fraud. While few customers were adversely affected, some suffered. So, prudent employees should be rewarded for not taking excessive risks and, in a complex organization, be encouraged to question the validity and prudence of decisions in other departments, especially where teamwork is needed for global integration. And maybe consider small penalties for thoughtless behaviors, like opening spam attachments.
5. Monitor Compliance by Internal and External Audits
An airtight outsourcing service agreement does not guarantee compliance. In the world of “Tech As A Service,” SaaS agreements should still require service providers to hire trusted independent external auditors for cybersecurity and business process management. Audits under SSAE 16 type 2 and ISO compliance principles are no guarantee, but they help demonstrate prudent business judgment.
6. Appointing Compliance Officer Reporting to the Board
While compliance should be built into the company’s DNA through leadership at the top and company policy manuals, appointing an internal auditor and compliance office can give the directors access to someone who worries for them.
7. Run Away at Your Own Risk
Normally, a director has the remedy of resigning as director in case of policy differences that cannot be reconciled. But running away might not be possible. In tort law, the doctrine of “last clear chance” imposes liability on the actor who fails to use all reasonable efforts, at the last minute before a disaster, to protect the imminent victim from a third-party’s foreseeable misdeeds. In corporate law, the fiduciary duty of loyalty may include a duty to not leave the corporation stranded when it falls into difficulties, since a new director might not be able to rectify the problems as quickly as the knowledgeable director seeking to walk away. So the director’s job is never done, especially if there is no easy alternative but to persevere in the exercise of prudent business judgment. No one hired you to quit when the risks are high and no one else can do a quick turn-around.
8. Identify Your Goals as Director and Apply Early Warning Systems
In the 1960’s, the NORAD “distant early warning” system deployed advanced radar to identify incoming hostile missiles. Today’s corporate director needs a system for identifying goals personally and for the corporation, with metrics, triggers and analytics for situations hostile to the corporation. If you don’t have the time or courage to set up your own warning systems, you might consider letting someone else do the job. Or characterize your role as “just an advisor” to the board.
In a new threatening world, the “business judgment” rule protecting corporate directors and officers from personal liability requires greater vigilance and broader risk management. A corporate director’s personal liability for the misdeeds of the corporation and its employees depends on how well the director planned for and responds to the “inevitable” corporate governance disaster such as:
- Neglect of safety of its workers or consumers using a useful but potential dangerous product;
- Abuses of consumer trust, such as setting up fictitious bank accounts to reward employees, without customer knowledge;
- A claim of persistent sexual harassment by the CEO (à la Steve Wynn) or;
- A business model based on unrestrained data aggregation and the “unforeseen” problem of unauthorized access or use by an authorized third parties data broker to the personal data of millions of online subscribers worldwide (à la Facebook and Cambridge Analytica).
1. Maintaining Independent Judgment despite Lack of Control Anticipating
It may be impossible to fulfill the directors’ duty of loyalty and to maintain one’s independent judgment if the CEO owns a majority of voting control of the company’s voting shares. That’s the case for Facebook, where Mark Zuckerberg, founder and CEO, owns about 10% of the shares but controls a majority of voting rights. If you displease the CEO, you could get fired from the board of a valuable and prestigious company. If you don’t displease the CEO, you might not have exercised independent judgment. So you need to identify and implement measures that will be best for the company, which could include mandating certain actions by the CEO who is in control of your position as director. And your D&O insurance carrier expects nothing less so as to mitigate any payouts on the inevitable derivative claims by shareholders.
2. Identify Worst Scenarios for Your Particular Business and Your Value Chain
From an insurer’s perspective, risk management requires identification and assessment of risks for probability and adverse impact. The digital economy increases the number and nature of risks.
Public companies must identify their risk profile in their quarterly and annual SEC reports. Private companies must likewise disclose key risks on private placement memoranda, loan applications, and prospective acquirers in shareholder meetings under the principle of shareholder democracy. For Wynn Resorts, an empire built on gambling casinos and flashy entertainment, the risks of sexual predation by the founder, who has access to private suites and private transportation, was predictable to directors who focus on high-probability risk analysis. For Facebook, a director who understands the business model of vacuuming personal data from subscribers and their network of “friends” for resale to “data consolidators” like Cambridge Analytica could predict a failure of accountability in the value chain. At a minimum, all supply chain contracts should guarantee that the corporation’s trusted data and business secrets will be protected and that any governmental mandates (such as privacy protections) applicable to the supplier’s services should flow down to the supplier.
Since worst case scenarios change over time, anticipating how changes in laws, politics and public opinion becomes part of the director’s job too. No one asked, but it’s your duty to worry and plan.
3. Insulate and Compartmentalize Processes; Identify Failure Switches
The Titanic sank because it hit an iceberg at high speed at night. Appropriately, the captain went down with the ship, but so did many hundreds more. The ship was designed to withstand four breached compartments, but not five. The lessons today are, don’t accelerate in risky waters and insulate and compartmentalize to insulate the business operation from cumulative, cascading risks.
For international companies, a private cloud might effectively limit risk. Minimization of cross-border transfers of sensitive personal data can be done by using multiple servers, two in each country (the second is for failover). Insulation can also be achieved by pseudonymization, a new concept advocated by the EU’s GDPR that stops short of full encryption but achieves compliance … until the code is broken.
4. Incentivize Prudent Behaviors by Employees
Wells Fargo made the mistake of incentivizing its bank branch officers to create new accounts not requested by the customers. The IT department and compliance departments were asleep and could have stopped this fraud. While few customers were adversely affected, some suffered. So, prudent employees should be rewarded for not taking excessive risks and, in a complex organization, be encouraged to question the validity and prudence of decisions in other departments, especially where teamwork is needed for global integration. And maybe consider small penalties for thoughtless behaviors, like opening spam attachments.
5. Monitor Compliance by Internal and External Audits
An airtight outsourcing service agreement does not guarantee compliance. In the world of “Tech As A Service,” SaaS agreements should still require service providers to hire trusted independent external auditors for cybersecurity and business process management. Audits under SSAE 16 type 2 and ISO compliance principles are no guarantee, but they help demonstrate prudent business judgment.
6. Appointing Compliance Officer Reporting to the Board
While compliance should be built into the company’s DNA through leadership at the top and company policy manuals, appointing an internal auditor and compliance office can give the directors access to someone who worries for them.
7. Run Away at Your Own Risk
Normally, a director has the remedy of resigning as director in case of policy differences that cannot be reconciled. But running away might not be possible. In tort law, the doctrine of “last clear chance” imposes liability on the actor who fails to use all reasonable efforts, at the last minute before a disaster, to protect the imminent victim from a third-party’s foreseeable misdeeds. In corporate law, the fiduciary duty of loyalty may include a duty to not leave the corporation stranded when it falls into difficulties, since a new director might not be able to rectify the problems as quickly as the knowledgeable director seeking to walk away. So the director’s job is never done, especially if there is no easy alternative but to persevere in the exercise of prudent business judgment. No one hired you to quit when the risks are high and no one else can do a quick turn-around.
8. Identify Your Goals as Director and Apply Early Warning Systems
In the 1960’s, the NORAD “distant early warning” system deployed advanced radar to identify incoming hostile missiles. Today’s corporate director needs a system for identifying goals personally and for the corporation, with metrics, triggers and analytics for situations hostile to the corporation. If you don’t have the time or courage to set up your own warning systems, you might consider letting someone else do the job. Or characterize your role as “just an advisor” to the board.
Subscribe to:
Posts (Atom)