Picture your client telling you they were considering starting a litigation, but that they did not yet have all the facts needed for you to prepare a pleading.  Now add the wrinkle that the action would need to be forumed in a foreign country, one with discovery rules narrower than those in the United States, and then the kicker, that some of the relevant documents are held by third parties outside of the planned litigation forum.  Although your initial reaction might be that your client is out of luck, 28 U.S.C. § 1782, which allows foreign litigants (or soon-to-be litigants) to obtain discovery in the United States, under U.S. discovery rules, for use in a pending or contemplated foreign proceeding, might offer some help.

Under Section 1782, a federal courts can grant an application for discovery in aid of a foreign proceeding (or planned proceeding) if the applicant: (a) has an interest in the foreign proceeding; (b) the discovery will be used in that foreign proceeding; and (c) the target of the discovery request resides in the judicial district where the request is made.[1]  However, federal courts can deny the discovery request, even when those statutory factors are met, based on purely discretionary factors such as whether the target is a party to the litigation, whether the applicant is attempting to circumvent either U.S. or foreign proof gathering restrictions, and whether the requests are found “unduly burdensome.”[2]  Although one might think that overworked federal courts would often use those discretionary factors to deny discovery requests in support of litigation pending in a far-flung forum, federal courts routinely grant Section 1782 applications.  Two recent decisions—one granting and one denying a Section 1782 application—show just how broad discovery under Section 1782 can be. Continue Reading The Broad Scope of 28 U.S.C. Section 1782

One benefit of living in the digital age is that we no longer need to travel to our attorney’s office to place a wet signature on an important contract or mortgage document. Parties now regularly execute multi-million dollar real estate transactions, non-competition agreements, and stock purchases, among other agreements, using digital signature applications. The most often used application, DocuSign, boasts that its solution enables you to electronically sign while meeting the requirements of the ESIGN Act and the Uniform Electronic Transactions Act in the United States, in addition to complying with most other laws in countries where electronic signatures are recognized.

As trial lawyers who often encounter these agreements after a deal has soured, we now have an additional evidentiary burden as we lay a foundation in court and authenticate these documents which the parties “signed” digitally. As with traditional wet signatures, we can anticipate that in some instances we will need to prove that the obligee digitally “signed” the document after he or she denies doing so.

DocuSign offers multiple levels of security and authentication that allow a sender to determine how thoroughly a signer must identify him or herself, including using email, access codes, SMS, phone, and knowledge based identity checks. In these cases, reviewing the authentication data is the digital equivalent of hiring a handwriting expert to authenticate a contract signature. Continue Reading Authenticating Digital Signatures at Trial

Just when we thought we had an remote understanding on how the California Consumer Privacy Act (“CCPA”) would work from an enforcement and penalty perspective, Senate Bill 561 was introduced on February 22. The bill has the full support of Attorney General Xavier Becerra and appears to be heading for a vote; the odds are favoring passage.

It is not surprising that the Attorney General supports the proposed changes because they remove some of the biggest headaches for enforcement and administration. These include elimination of the Attorney General’s obligation to provide guidance to businesses, upon request, about how to comply with the CCPA, and removal of a 30-day cure period before enforcement actions can begin.

In addition to relieving the Attorney General’s administration and enforcement constraints, SB 561 contains a more drastic and significant change. By the removal of one short sentence, SB 561 expands the individual cause of action for statutory damages beyond narrowly defined data breach situations (unauthorized access and exfiltration, theft, or disclosure of their non-encrypted or non-redacted personal information) and throws open the doors. Under the proposed version, any consumer with a claim that his or her CCPA rights are violated (presumably in any manner) may bring a civil suit and claim statutory damages of up to $750 per incident. This change, combined with the ability for claims to be pursued on class-wide basis, could be a potential bonanza for plaintiffs’ attorneys.

The proposed revision keeps the 30-day cure period for individual claims, although the grace period is removed for the Attorney General’s enforcement actions.  This is some small relief for individual claims, although it is still difficult to imagine how a business could “cure” a data breach or other incident violation, such as a failure to respond to a consumer request in the proscribed period of time. It is conceivable that the 30 day cure could provide some defense against de minimis technical violations, like the failure to provide appropriate notification language, disclosures, or contact information for consumers. Arguably, even the failure to provide an adequate response to a cure notice (“an express written statement that the violations have been cured and that no further violations shall occur…”) could itself raise a claim for statutory damages.

From a business and commercial compliance standpoint, it is starting to appear that the stakes will be even higher on January 1, 2020.

Every day all over the world, companies fall victim to cybersecurity attacks.  It’s nearly a constant these days.  Many of these attacks are preventable with the right amount of attention to detail in system setup and hardening.  The three common themes in postmortem examination of all of these attacks boil down to 1) human error; 2) configuration error; 3) failing to proactively defend.  In this series of six posts, we will dive into each attack’s anatomy, the attack vector, and the ways companies can attempt to avoid being victim to them.  In the last post, guest bloggers from G2 Insurance will walk through how insurance companies react to claims, what to watch out for in your policies, and appropriate coverage levels for cyber insurance based on their experience handling claims.

#1  Email Spoofing and Wire Fraud

This attack is essentially a wire instruction interception/redirection or wholly fake request for a transfer.  This is an event that comes up daily or at least weekly in any cybersecurity professional’s world.  This attack typically plays out with a threat actor masquerading as a legitimate authority within a company, typically someone in the C-suite or Director level.  To make it successful, the recipient of the wire transfer request has to believe it’s legitimately originating from one of those authoritative people.

One way attackers do this is using actual stolen credentials.  Despite the flood of data security breaches and database hacks, people unfortunately still use weak passwords and also re-use passwords.  We have seen dozens of instances of successful credential attacks where the attacker used publicly available database leak information to gain unauthorized access to corporate accounts.  The approach goes like this: an attacker harvests information regarding corporate leadership from various data sources about companies (LinkedIn, Dunn & Bradstreet, Bloomberg, Google Finance) and chooses a few people to target.  They then cross-reference those names to leaked credential databases, often times hosted on Darkweb sites, IRC chat rooms, or other forums dedicated to hacking.  If the attacker is able to find other accounts belonging to their targets that have been compromised and have a password, they can try that password, and tens of thousands of variations of it, to attack the corporate account of their victim.

Continue Reading Top Five Most Common Cybersecurity Attacks and How to Prevent Them – Part 1: Email Spoofing and Wire Fraud

California, home to more than 40 million people and the 5th largest economy in the world, has passed the California Consumer Privacy Act (CCPA), its omnibus consumer privacy law. The law creates sweeping new requirements concerning the collection, maintenance, and tracking of information for both employees or customers who are residents of California. Many aspects of the implementation and enforcement are still being finalized by the California Attorney General. However, companies with employees or customers in California need to take stock of the information they are processing that could qualify as “personal information” for California residents, and they need to begin establishing mechanisms for compliance before the end of 2019. Continue Reading The California Consumer Privacy Act of 2018: What Businesses Need to Know Now

This weekend, Google was fined 50 million euros (over $55 million) by France’s Data Privacy Authority,  CNIL, for breaching Europe’s (fairly) new General Data Protection Regulation.

GDPR lays the framework for the legal processing of personal data, requiring that companies  have a lawful basis for processing a user’s personal information.  This lawful basis can result from the user’s genuine consent prior to collecting personal information; processing necessary for the performance of a contract, compliance with a legal obligation, to protect the vital interests of a data subject or natural person, for the performance of a task in the public’s interest, or for the purpose of the legitimate interests of a controller or third party.

The GDPR went into effect on May 25, 2018.  Shortly after its enactment, two privacy rights groups, noyb (Max Schrems’ brainchild) and La Quadrature du Net (LQDN) filed complaints against Google with the CNIL. The noyb complaint was filed on May 25, the same day the Regulation took effect.  Continue Reading Google First “Tech Giant” to be Fined for Violating GDPR

On January 4, 2019, the California Court of Appeal, First Appellate District issued an opinion reminding us that under California law, tax returns are privileged and improper disclosure of them can even potentially rise to tortious invasion of privacy claims in overturning a demurrer as to that claim. Strawn v. Morris, Polich & Purdy, LLP, No. A150562, 2019 Cal. App. LEXIS 9 (Ct. App. Jan. 4, 2019).

Federal and state tax returns have been held to be privileged from disclosure under California law. Id at *13; Wilson v. Superior Court, 63 Cal. App. 3rd 825, 828 (1976); Webb v. Standard Oil Co., 49 Cal. 2nd 509, 512-513 (1957).  As highlighted by the opinion, the purpose of the privilege “is to encourage voluntary filing of tax returns and truthful reporting of income, and thus to facilitate tax collection.” Strawn at *13; Weingarten v. Superior Court, 102 Cal. App. 4th 268, 274 (2002); Webb at 513.  Continue Reading The Privileged Nature of Tax Returns in California

Prevention, Crisis Management, and Mitigating Personal Liability

Thursday, January 31, 2019
8:00 a.m. – 8:30 a.m. Breakfast & Registration
8:30 a.m. – 10:30 a.m. Program

Seyfarth Shaw LLP New York Office
The New York Times Building
620 Eighth Avenue
New York, NY 10018

Seyfarth Attorneys:

Kevin Lesinski
Richard Lutkus
Gregory Markel
William Prickett

There is no cost to attend but registration is required and seating is limited.

This program will provide Boards, C-Suites and General Counsels with best practice strategies for avoiding unauthorized breaches of electronic data; managing them if they occur; and addressing personal liability risks for Boards and executives. The Distinguished Speakers are experienced cyber security experts from Seyfarth Shaw, KPMG, law enforcement, and current directors.

Best Practices for Avoiding and Managing Threats

Cybersecurity experts and industry professionals will share their views on these questions:

  • What are your top lessons learned from investigating cyber breach incidents?
  • What are the most important considerations when developing an overall incident response plan?

Potential Liability Risk for the Board 

Securities litigators will emphasize the importance of having a clear plan and robust escalation processes to respond quickly and effectively when an incident occurs. Critical issues to be discussed include:

  • Fiduciary duties and director liability
  • Cyber risk landscape and regulatory environment
  • Role of information governance in minimizing damages from cyberattacks
  • Cyber risk assessment and implementation of defensive technology
  • Insurance coverage and other risk mitigation strategies

Two hours of New York CLE credits are approved.

If you have any questions, please contact Morgan Coury at mcoury@seyfarth.com and reference this event.

Seyfarth Shaw Partner Jason Priebe was recently interviewed by C4CM regarding his tips for records retention.  This thoughtful discussion covered not only record retention policies, but information governance, risk, and potential costs resulting from the increasing volume of data produced during litigation.  Jason also provided practical steps to formulate a record retention policy when one is not in place.  To learn more, read the full interview here.

November 16, 2018 – President Donald Trump signed the Cybersecurity and Infrastructure Security Agency Act of 2018, which establishes the Cybersecurity and Infrastructure Security Agency (“CISA”) at the Department of Homeland Security (DHS).  The law reorganizes DHS’ National Protection and Programs Directorate (NPPD) into an agency that will focus on cybersecurity threats.

With its promotion to the rank of federal agency, CISA is now on the same level as the Federal Emergency Management Agency (FEMA) and the Secret Service, but still under the DHS’ oversight. The new agency is expected to improve the cybersecurity defenses across other US federal agencies, coordinate cybersecurity programs with states, and bolster the government’s overall cybersecurity protections.

It was also announced that Christopher C. Krebs would serve as CISA’s first director.  Mr. Krebs had served as the Under Secretary of the NPPD, the predecessor of CISA.  On the day President Trump signed the bill into law, Mr. Krebs tweeted that “The cybersecurity threat is constantly evolving and this reorganization positions us [CISA] to better defend America’s infrastructure from digital and physical threats.”  Mr. Krebs added that the new agency would be better able to “accomplish its cybersecurity mission by making it easier to recruit cybersecurity professionals.”

CISA unveiled its new logo on November 28, 2018.  With the rise of cybersecurity threats across the country, it is likely that the logo will become a familiar face to many Americans in the coming years.