On January 4, 2019, the California Court of Appeal, First Appellate District issued an opinion reminding us that under California law, tax returns are privileged and improper disclosure of them can even potentially rise to tortious invasion of privacy claims in overturning a demurrer as to that claim. Strawn v. Morris, Polich & Purdy, LLP, No. A150562, 2019 Cal. App. LEXIS 9 (Ct. App. Jan. 4, 2019).

Federal and state tax returns have been held to be privileged from disclosure under California law. Id at *13; Wilson v. Superior Court, 63 Cal. App. 3rd 825, 828 (1976); Webb v. Standard Oil Co., 49 Cal. 2nd 509, 512-513 (1957).  As highlighted by the opinion, the purpose of the privilege “is to encourage voluntary filing of tax returns and truthful reporting of income, and thus to facilitate tax collection.” Strawn at *13; Weingarten v. Superior Court, 102 Cal. App. 4th 268, 274 (2002); Webb at 513.  Continue Reading The Privileged Nature of Tax Returns in California

Prevention, Crisis Management, and Mitigating Personal Liability

Thursday, January 31, 2019
8:00 a.m. – 8:30 a.m. Breakfast & Registration
8:30 a.m. – 10:30 a.m. Program

Seyfarth Shaw LLP New York Office
The New York Times Building
620 Eighth Avenue
New York, NY 10018

Seyfarth Attorneys:

Kevin Lesinski
Richard Lutkus
Gregory Markel
William Prickett

There is no cost to attend but registration is required and seating is limited.

This program will provide Boards, C-Suites and General Counsels with best practice strategies for avoiding unauthorized breaches of electronic data; managing them if they occur; and addressing personal liability risks for Boards and executives. The Distinguished Speakers are experienced cyber security experts from Seyfarth Shaw, KPMG, law enforcement, and current directors.

Best Practices for Avoiding and Managing Threats

Cybersecurity experts and industry professionals will share their views on these questions:

  • What are your top lessons learned from investigating cyber breach incidents?
  • What are the most important considerations when developing an overall incident response plan?

Potential Liability Risk for the Board 

Securities litigators will emphasize the importance of having a clear plan and robust escalation processes to respond quickly and effectively when an incident occurs. Critical issues to be discussed include:

  • Fiduciary duties and director liability
  • Cyber risk landscape and regulatory environment
  • Role of information governance in minimizing damages from cyberattacks
  • Cyber risk assessment and implementation of defensive technology
  • Insurance coverage and other risk mitigation strategies

Two hours of New York CLE credits are approved.

If you have any questions, please contact Morgan Coury at mcoury@seyfarth.com and reference this event.

Seyfarth Shaw Partner Jason Priebe was recently interviewed by C4CM regarding his tips for records retention.  This thoughtful discussion covered not only record retention policies, but information governance, risk, and potential costs resulting from the increasing volume of data produced during litigation.  Jason also provided practical steps to formulate a record retention policy when one is not in place.  To learn more, read the full interview here.

November 16, 2018 – President Donald Trump signed the Cybersecurity and Infrastructure Security Agency Act of 2018, which establishes the Cybersecurity and Infrastructure Security Agency (“CISA”) at the Department of Homeland Security (DHS).  The law reorganizes DHS’ National Protection and Programs Directorate (NPPD) into an agency that will focus on cybersecurity threats.

With its promotion to the rank of federal agency, CISA is now on the same level as the Federal Emergency Management Agency (FEMA) and the Secret Service, but still under the DHS’ oversight. The new agency is expected to improve the cybersecurity defenses across other US federal agencies, coordinate cybersecurity programs with states, and bolster the government’s overall cybersecurity protections.

It was also announced that Christopher C. Krebs would serve as CISA’s first director.  Mr. Krebs had served as the Under Secretary of the NPPD, the predecessor of CISA.  On the day President Trump signed the bill into law, Mr. Krebs tweeted that “The cybersecurity threat is constantly evolving and this reorganization positions us [CISA] to better defend America’s infrastructure from digital and physical threats.”  Mr. Krebs added that the new agency would be better able to “accomplish its cybersecurity mission by making it easier to recruit cybersecurity professionals.”

CISA unveiled its new logo on November 28, 2018.  With the rise of cybersecurity threats across the country, it is likely that the logo will become a familiar face to many Americans in the coming years.

Seyfarth Synopsis: Please join us at our Chicago Willis Tower office on Thursday, December 6th, for breakfast along with a Seyfarth Legal Forum and Continuing Legal Education (CLE): 2018 Highlights and a Look Ahead to 2019.

About the Program

Providing our clients with a multidisciplinary overview of Legal Hot Button issues and Best Practice.  Featuring:

  • Biometric Information Privacy Act: What a long, strange year it’s been (and there’s more on the way!)
  • Legalize it: will Illinois go from medical to recreational marijuana and what would that mean to the real estate industry?
  • Affordable Care Act Update & Enforcement Activities, 401(k) Student Loan Repayment Arrangements, Socially Responsible Investments, and HIPAA Privacy & Security Audits
  • Mergers and Acquisitions: Current State of the Market and Post-Merger Integration Strategies
  • The “Cloud”…is in a building?: Data Centers are the newest, and maybe most important, type of real estate
  • Latest Developments in Pregnancy Accommodation (Illinois’ New Lactation Law and Nationwide Trends)
  • Litigation Hot Topics for 2019, including: Developments in trade secret and non-compete law; New laws affecting threshold issues such as forum selection and choice of law; Frontloaded discovery in federal court: Mandatory Initial Discovery Pilot Programs; Best practices for protecting the attorney-client privilege for in-house counsel
  • Welcome to the Future: It arrived yesterday – The intersection of Technology and Legal Services
  • Bots, bits and bytes… Artificial Intelligence and its leading role in recent legal projects

The program will feature a panel of Seyfarth Chicago subject matter experts — with an eye toward preparing for the developments in the coming year. Our overview will be targeted at highlighting issues for the General Counsel, Chief Information Officer, Chief Human Resource Officer, and other members of their teams.

The program will consist of an engaging ninety minute presentation with speakers from each of Seyfarth Chicago’s practice groups: Benefits, Corporate, Labor & Employment, Litigation, and Real Estate, as well as an exciting presentation on the use of technology in law. Then, we will offer 30 minute break-out sessions on hot topics warranting a deeper dive that companies are facing when looking at their legal compliance needs. The break-out sessions will address Privacy/Data Security, Managing in the #metoo Environment, and Blockchain/Cryptocurrency in business.

The program is on Thursday, December 6, 2018, at 8:00 a.m. – 8:30 a.m., for breakfast and registration, 8:30 a.m. – 10:00 a.m., for the panel presentations, and 10:00 a.m. – 10:30 a.m., for the breakout sessions.  Our offices are at 233 S. Wacker Drive, Suite 8000, in Chicago, IL.

While there is no cost to attend, registration is required and space is limited.  If you have any questions, please contact Fiona Carlon at fcarlon@seyfarth.com and reference this event.

Also, for those that need the credits, note that Seyfarth Shaw LLP is an approved provider of Illinois CLE credit. This seminar is approved for 1.5 hours of CLE credit CA, IL, NY, NJ and TX. CLE Credit is pending for GA and VA. HR professionals: please note that the HR Certification Institute accepts CLE credit toward recertification.

The European Data Protection Board (EDPB) recently issued a report after their November 16, 2018 plenary session.  The statement covered a range of topics being discussed by the Board, but no substantive publications.  The EDPB is charged with ensuring that GDPR is applied consistently across the EU and that there is consistent enforcement by DPAs across the Union.  The Board is also tasked with issuing guidelines on the interpretation the GDPR (formerly the charge of the Article 29 Working Party), and making binding decisions about cross-border disputes.  The Board is made up of the head DPA or representatives from each member country.

An EU-Japan adequacy finding appears to be extremely close, and the Board announced they are at work on guidelines about the intersection between Clinical Trials Regulation and the GDPR for medical device and pharmaceutical companies.  There have now been four “plenary meetings” of the EDPB.  Some may consider no action on the part of the Board a good thing, but there are some significant concepts which eventually need clarification, including a formal process and procedure on appeals of DPA enforcement and fines, and modernization of the outdated Model Contractual Clauses, among other things.  The essential message from the EDPB continues to be “stay tuned,” and seems likely that no real substantive publications will come through until early 2019.

The complete press release from the EDPB can be found here.

Seyfarth eDiscovery Partners Scott Carlson and Jay Carle were recently interviewed by Mary Rechtoris of Relativity regarding “Doing Discovery Right: How Seyfarth Shaw Tackles eDiscovery.”  They discuss the Group’s formation, along with the growing importance of eDiscovery attorneys as technology changes both for clients, and in the eDiscovery space.

View the full post on Relativity’s Blog here!

This morning, the European Commission released a Proposal for a Regulation addressing the EU’s cybersecurity industry as part of its next step towards a Digital Single Market, which is the EU’s strategy to ensure fair competition, consumer and data protection, and removal of copyright and geo-blocking issues for individuals participating in online activities and accessing online content.  The Regulation would establish the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres in order to “equip Europe with the right tools to deal with an ever-changing cyber threat.”  See their Fact Sheet here.  The EU has various initiatives in place to address today’s current cyber threats, as well as the deterrence of future attacks.  Specifically, it is working with member states to improve cybersecurity initiatives, EU-level cooperation, and risk prevention, and plans to establish an EU-wide certification framework to ensure products and services are cyber-secure.  Today’s proposal carries these initiatives further by suggesting the creation of a Network of Competence Centres and a European Cybersecurity Industrial, Technology and Research Competence Centre “to develop and roll out the tools and technology needed to keep up with an ever-changing threat.”  See Fact Sheet.  The Commission is hoping that the creation of this Network will allow the many existing cybersecurity competence centres in the EU to pool and share information and expertise, help deploy EU cybersecurity products and solutions, and facilitate cooperation between industries and communities.  The Network will unite existing member state centres and allow them to co-invest to drive research and innovation, and allow for additional investment and funding to improve the EU’s digital economy, and the Centre will aid in facilitating the work of the Network.

Under this framework, each EU member state will be responsible for nominating one national coordination centre which will essentially be that country’s leader and representative to the community; these local centres will carry out actions under the Regulation, as well as determine the distribution of funds on a local level.  The Commission expects that creation of one, centralized framework will allow for increased coordination and exchange of expertise and knowledge, cost savings though co-investment, and opportunity for the EU to become a global leader in cybersecurity.

Seyfarth Shaw Partner Jordan Vick is on the panel for the “Playing by the Rules: Rule Changes Essential to Your Practice” session on Friday, November 16, at Georgetown Law’s 15th annual Advanced eDiscovery Institute in Washington, D.C.

Session topics include:

  • The 2015 Amendments to the FRCP and their actual impacts on practitioners, including unintended consequence
  • How the changes to Federal Rule of Evidence 902 will change how parties and the court can streamline authentication of ESI and potentially eliminate the need to call a witness at trial
  • What other changes the Rules Committee is discussing that may impact eDiscovery professionals
  • Pilot accelerated disclosures and their impacts in Illinois and Arizona, including the Mandatory Initial Discovery Pilot Program (“MIDP”) in the Northern District of Illinois

For more information, to see the full schedule, or to register, click here.

At the end of June, the California legislature passed its Bill 375, the California Consumer Privacy Act of 2018.  The Act contains a number of concepts that would be familiar to those who are working to bring their companies and organizations into compliance with GDPR.  The new law defines a category of “Personal Information” that radically departs from a traditional definition of Personal Data commonly found in various State Data Privacy Laws, which usually ties an individual name to other identifiers like social security number, account number, or other factors.  Instead, the California Act defines “Personal Information” as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.  It does not, mercifully, include publicly available information, but it still comes closer to a GDPR-like definition of “personal data” than any other US law.

The Act provides California residents some rights that also appear familiar.  For example:

  • Consumers can request a copy of all the Personal Information a business has collected;
  • Consumers have the right to request that the business delete their Personal Information (subject to some exceptions), and a right to direct a company to not share their Personal Information with third parties; and
  • Consumers can request that a business disclose the categories of information it has collected, the sources of information, the purpose for the collection and/or its sale of the information, and the third parties with whom the information is shared.

Continue Reading California’s Consumer Privacy Act of 2018 – Get Ready for New GDPR Style Requirements in the US