Our colleague at Epstein Becker Green has a post on the Retail Labor and Employment Law blog that will be of interest to our readers in the technology industry: “DOJ Finally Chimes In On State of the Website Accessibility Legal Landscape – But Did Anything Really Change?

Following is an excerpt:

As those of you who have followed my thoughts on the state of the website accessibility legal landscape over the years are well aware, businesses in all industries continue to face an onslaught of demand letters and state and federal court lawsuits (often on multiple occasions, at times in the same jurisdiction) based on the concept that a business’ website is inaccessible to individuals with disabilities. One of the primary reasons for this unfortunate situation is the lack of regulations or other guidance from the U.S. Department of Justice (DOJ) which withdrew long-pending private sector website accessibility regulations late last year. Finally, after multiple requests this summer from bi-partisan factions of Members Congress, DOJ’s Office of Legislative Affairs recently issued a statement clarifying DOJ’s current position on website accessibility. Unfortunately, for those hoping that DOJ’s word would radically alter the playing field and stem the endless tide of litigations, the substance of DOJ’s response makes that highly unlikely.

DOJ’s long-awaited commentary makes two key points…

Read the full post here.

Join Epstein Becker Green attorneys, Brian G. Cesaratto and Brian E. Spang, for a discussion of how employers can best protect their critical technologies and trade secrets from employee and other insider threats. Topics to be discussed include:

  • Determining your biggest threat by using available data
  • What keeps you up at night?
  • Foreseeing the escalation in risk, from insider and cyber threats to critical technologies
  • New protections and remedies under the Trade Secret Protection Act of 2014
  • Where are your trade secrets located, and what existing protections are in place?
  • What types of administrative and technical controls should your firm consider implementing for the key material on your network to protect against an insider threat?
  • What legal requirements may apply under applicable data protection laws?
  • How do you best protect trade secrets and other critical technologies as information increasingly moves into the cloud?
  • Using workforce management and personnel techniques to gain protection
  • The importance of an incident response plan
  • Developing and implementing an effective litigation response strategy to employee theft

Wednesday, October 3, 2018.
12:30 p.m. – 2:00 p.m. ET
Register for this complimentary webinar today!

Our colleagues at Epstein Becker Green has a post on the Retail Labor and Employment Law blog that will be of interest to our readers in the technology industry: “NYC Commission on Human Rights Issues Guidance on Employers’ Obligations Under the City’s Disability Discrimination Laws.”

Following is an excerpt:

The New York City Commission on Human Rights (“Commission”) recently issued a 146-page guide titled “Legal Enforcement Guidance on Discrimination on the Basis of Disability” (“Guidance”) to educate employers and other covered entities on their responsibilities to job applicants and employees with respect to both preventing disability discrimination and accommodating disabilities. The New York City Human Rights Law (“NYCHRL”) defines “disability discrimination” more broadly than does state or federal disability law, and the Guidance is useful in understanding how the Commission will be interpreting and enforcing the law. …

Read the full post here.

Featured on Employment Law This Week: New Legislation Eases Disclosure Requirements for Startups under the Dodd-Frank Wall Street Reform.

Startups offering equity plans get regulatory relief. The legislation that President Trump signed in May to ease regulations under the Dodd-Frank Wall Street Reform and Consumer Protection Act also contained some good news for startups. The law adjusts the Rule 701 thresholds, which allow private companies to offer equity to employees without registering the sales as public offerings.

Watch the segment below.

The European Union’s (“EU’s”) General Data Protection Regulations (“GDPR”) go into effect on May 25, 2018, and they clearly apply to U.S. companies doing business in Europe or offering goods and services online that EU residents can purchase. Given that many U.S. companies, particularly in the health care space, increasingly are establishing operations and commercial relationships outside the United States generally, and in Europe particularly, many may be asking questions akin to the following recent inquiries that I have fielded concerning the reach of the GDPR:

What does the GDPR do? The GDPR unifies European data and privacy protection laws as to companies that collect or process the personally identifiable information (“PII” or, as the GDPR calls it, “personal data”) of European residents (not just citizens).

Who must comply? The GDPR applies to any company that has personal information of EU residents or citizens or that conducts business in the EU, regardless of its home country.

What is the risk of non-compliance? The GDPR mandates documented compliance. The regulations provide for substantial fines of up to €20 million or 4 percent of global revenues for noncompliance. Willful non-compliance is most heavily fined under this tiered system.

How far along are most companies as to compliance? The consulting firm Gartner estimates that more than half of the companies that are subject to the GDPR will not be in compliance throughout this year. They will be at risk.

Who will adopt the regulations? All 28 EU members, plus Iceland, Norway, and Liechtenstein (collectively known as the “European Economic Area”), and likely the United Kingdom, will adopt the regulations.

Will the regulations be enforced extraterritorially? The GDPR applies worldwide as to any company that offers goods or services (even if they are free) within the EU or collects, processes, or maintains (anywhere) personal data about European residents (again, not just citizens).

How is “personal data” defined? The definition includes any information as to a human being (called a “data subject”) that can directly or indirectly identify him or her, including, but not limited to, names; birthdates; physical addresses; email and IP addresses; and health, biometric, and demographic information.

What constitutes compliance? In general terms, a subject company must limit the use of the retained personal data and maintain it securely.

  • Explicit consent is required for each processing activity as to any covered datum.
  • Access, free of charge, must be afforded to any data subject on request to a “data controller” (a person at the company charged with maintaining data), who, in turn, must assure that any “data processor” (any person or company that takes data from consumers and manipulates or uses it in some way to then pass along information to a third party) is compliant as to the requested action.
  • Data subjects have the right to be “forgotten, i.e., to have their data expunged, and may revoke consent at will.

What does the GDPR require if there is a data breach? Data breaches that “may” pose a risk to individuals must be notified officially within 72 hours and to affected persons without undue delay.

This, of course, is only an outline of GDPR requirements and procedures. Any specific advice only can be provided knowing an individual company’s circumstances and needs. One does note that, as is the case in other regards, for example, antitrust, the assumptions prevalent within the EU are decidedly different from those in the United States. As a number of commentators have observed, while there is no defined “right of privacy” in the United States, a company is required to preserve information, including PII and personal health information, or PHI, in the event of litigation. In Europe, which has very limited litigation discovery, there is a defined right of privacy and individuals can cause data describing them to be erased (“forgotten”).

Many of you know also that there is a case pending a decision in the Supreme Court of the United States involving whether the U.S. government can compel Microsoft to produce PII that is collected and stored outside of the United States. An affirmative decision might create a conflict of law that will complicate the data retention abilities of American companies doing business overseas. So stay tuned.

Our colleague Daniel R. Levy, at Epstein Becker Green, has a post on the Trade Secrets & Employee Mobility blog that will be of interest to our readers: “It’s a Brave New World: Protecting Trade Secrets When Traveling Abroad with Electronic Devices.

Following is an excerpt:

Consider the following scenario: your organization holds an annual meeting with all Research & Development employees for the purpose of having an open discussion between thought leaders and R&D regarding product-development capabilities. This year’s meeting is scheduled outside the United States and next year’s will be within the U.S. with all non-U.S. R&D employees traveling into the U.S. to attend. For each meeting, your employees may be subject to a search of their electronic devices, including any laptop that may contain your company’s trade secrets. Pursuant to a new directive issued in January 2018 by the U.S. Custom and Border Protection (“CBP”), the electronic devices of all individuals, including U.S. citizens and U.S. residents, may be subject to search upon entry into (or leaving) the U.S. by the CBP. …

Read the full post here.

Our colleagues , at Epstein Becker Green, have a post on the Wage and Hour Defense Blog that will be of interest to many of our readers in the technology industry: “Labor Issues in the Gig Economy: Federal Court Concludes That GrubHub Delivery Drivers are Independent Contractors under California Law.”

Following is an excerpt:

Recently, a number of proposed class and collective action lawsuits have been filed on behalf of so-called “gig economy” workers, alleging that such workers have been misclassified as independent contractors. How these workers are classified is critical not only for workers seeking wage, injury and discrimination protections only available to employees, but also to employers desiring to avoid legal risks and costs conferred by employee status.  While a number of cases have been tried regarding other types of independent contractor arrangements (e.g., taxi drivers, insurance agents, etc.), few, if any, of these types of cases have made it through a trial on the merits – until now.

In Lawson v. GrubHub, Inc., the plaintiff, Raef Lawson, a GrubHub restaurant delivery driver, alleged that GrubHub misclassified him as an independent contractor in violation of California’s minimum wage, overtime, and expense reimbursement laws.  In September and October 2017, Lawson tried his claims before a federal magistrate judge in San Francisco.  After considering the evidence and the relevant law, on February 8, 2018, the magistrate judge found that, while some factors weighed in favor of concluding that Lawson was an employee of GrubHub, the balance of factors weighed against an employment relationship, concluding that he was an independent contractor. …

Read the full post here.

On January 30, in New York City, our colleague Michelle Capezza of Epstein Becker Green will be a panelist at the “2018 Technology Economic & Financial Outlook,” hosted by the New Jersey Tech Council (NJTC).

From the “internet of things,” to the cloud, to autonomous cars, there is not a single industry segment that has not leveraged technology to develop better products and services for the benefit of their customers as well as their stakeholders.  As technology makes the world smaller, it also opens up endless opportunities for creativity and innovation. The panel will discuss the impact that technology will have in 2018 on the regional, domestic, and global economic and financial environment.

For more information, visit NJTC.org.

Steven R. Blackburn, Member of the Firm in the Employment, Labor & Workforce Management practice will co-present a Practising Law Institute in-person event and webcast on January 25, 2018 at 10:00 a.m. PST titled “Tech Sector Employment Law Hot Topics for the California Lawyer.

This event will address current California employment law issues, with the added focus of how the latest, state-specific legal developments impact the tech sector, in particular.

Steven R. Blackburn’s program is titled, “Sexual Harassment in the Tech Sector – Employer Duties, Investigations and Managing Claims,” and will address the following:

  • Employer, board and fiduciary duties in a harassment claim
  • Avoiding common pitfalls when investigating harassment
  • Assessing risk vulnerability to high level employees
  • Recent wave of sexual harassment revelations – what makes this time different?
  • Social media’s role in exposing sexual harassment, it’s impact in how investigations are managed

MCLE credit is available for participating in the program.

For more information and to register for this webcast, click here.

As 2017 comes to a close, recent headlines have underscored the importance of compliance and training. In this Take 5, we review major workforce management issues in 2017, and their impact, and offer critical actions that employers should consider to minimize exposure:

  1. Addressing Workplace Sexual Harassment in the Wake of #MeToo
  2. A Busy 2017 Sets the Stage for Further Wage-Hour Developments
  3. Your “Top Ten” Cybersecurity Vulnerabilities
  4. 2017: The Year of the Comprehensive Paid Leave Laws
  5. Efforts Continue to Strengthen Equal Pay Laws in 2017

Read the full Take 5 online or download the PDF.