Global Crisis Management Series:  This post is part 11 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

Upon receiving a request for information from a governmental authority or other agency, it is critical to make early strategic decisions about how to respond to the request and effectively frame the scope of the inquiry.  Generally speaking, there are two overarching goals that typically inform a company’s strategy for responding to requests for information: (i) to provide the requesting authority the information it seeks as efficiently as possible while maintaining credibility and (ii) to appropriately frame and cabin the scope of inquiry to minimize the burden on the company.  To do so, the party receiving the request should first explore a number of foundational questions to understand the context of and motivation for the request. Continue Reading Five Important Questions for Addressing an Investigative Request

Global Crisis Management Series:  This post is part 10 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

In an increasingly global, regulated, and litigious environment, companies face unanticipated and potentially destabilizing events that often play out in the public eye.  Frequently, the issues organizations face during large-scale, often public, crises require more than exclusively legal skills, but also communications skills.  Below we discuss three key steps in the process for handling the public relations aspects of any crisis: (1) assembling a crisis-response team, (2) deciding whether or not to make a public statement, and (3) crafting the public message. Continue Reading Public Relations Considerations When Managing a Crisis

Responding to a request by the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE), the EU’s data protection supervisory bodies released an initial joint opinion on the impact of the U.S. Clarifying Lawful Overseas Use of Data Act (“CLOUD Act”) on the EU data protection framework.

The preliminary assessment by the European Data Protection Supervisor (“EDPS”) and European Data Protection Board (“EDPB”) leaves service providers facing a familiar dilemma.

Although the CLOUD Act now makes clear that U.S. disclosure orders have an extraterritorial reach, the EDPS and EDPB see very limited options for service providers to comply with such orders without breaching the EU’s General Data Protection Regulation (“GDPR”).

Companies will have to carefully consider whether to store data with service providers that may be subject to the Act.

Please click here to read the full alert memorandum.

On August 26, 2019, New York Governor Andrew Cuomo signed into law legislation extending the statute of limitations for claims brought under the Martin Act from three to six years. The statute reverses a New York Court of Appeals decision holding that Martin Act claims must be brought within three years. Continue Reading New York States Extends the Statute of Limitations for Claims Brought Under Martin Act to Six Years

Global Crisis Management Series:  This post is part 9 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

The Dodd-Frank Wall Street Reform and Consumer Protection Act (“ Dodd-Frank”) goes further than other statutes in providing protection to whistleblowers.  In addition to broadening prohibitions against retaliation, the Securities and Exchange Commission (“SEC”) promulgated Rule 21F-17 to ensure companies could not interfere with an individual’s efforts to raise concerns and communicate directly with the SEC.[1]

SEC Rule 21F–17(a) prohibits any person from “imped[ing] an individual from communicating directly with the [SEC] about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement.”[2]  Following a series of enforcement actions in 2015 and 2016, the Office of Compliance Inspections and Examinations (“OCIE”) issued a Risk Alert urging companies to evaluate whether their confidentiality and non-disclosure agreements, among other internal documentation, contained provisions that were inconsistent with Rule 21F–17.[3]  Companies can implement a few simple best practices to ensure compliance with Rule 21F–17. Continue Reading Rule 21F–17: Guidance on Drafting Confidentiality and Non-Disclosure Agreements

Global Crisis Management Series:  This post is part 8 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

U.S. whistleblower protections broadly provide public and private sector employees with protection from retaliation for reporting potential concerns about misconduct.  Companies that are ill-prepared to handle complaints internally not only face potential lawsuits from whistleblowers, but also open themselves up to substantial regulatory scrutiny and perhaps enforcement actions.  Continue Reading Five Building Blocks for Effective Internal Controls to Comply with U.S. Whistleblower Protections

In late July 2019, U.S. federal and state regulators announced three headline‑grabbing data privacy and cybersecurity enforcement actions against Equifax and Facebook.  Although coverage of these cases has focused largely on their striking financial penalties, as important are the terms the settlements imposed on the companies’ operations as well as their officers, directors, and compliance professionals—and what they signal about potential future enforcement activity to come. Continue Reading July 2019 Privacy and Cybersecurity Enforcement: Lessons for Management and Directors

Global Crisis Management Series:  This post is part 7 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

While legal protections for whistleblowers in the United States were first adopted in the late 1970s for federal employees, statutory protections enacted in the last 20 years have substantially increased protection beyond the federal workforce to certain private-sector employees.  These protections create a number of potential issues for companies today, ranging from employee retaliation lawsuits to regulatory investigations.

This note provides a high-level description of the primary whistleblower legal protections in the United States today.  Companies are well-advised to keep these protections in mind as they implement and enhance their compliance programs.  The right policies and procedures—tailored to a company’s particular risk profile—can reduce the risk of whistleblower complaints and ensure that concerns are appropriately investigated internally and remediated as necessary to reduce costly and intrusive regulatory scrutiny.  Continue Reading Whistleblowers: Who Are They and Why Should You Care?

On July 25, 2019, New York Governor Andrew Cuomo signed into law the Stop Hacks and Improve Electronic Data Security Act (the “SHIELD Act” or the “Act”), which expands data breach notification obligations under New York law and for the first time imposes affirmative cybersecurity obligations on covered entities.

The Act makes five principal changes to existing New York law:

  1. Expanding the law’s jurisdiction to entities that maintain private information of New York residents, regardless of whether or not such entities actually conduct business within the State;
  2. Broadening the scope of “private information” triggering notification obligations in the event of a breach, including to biometric data;
  3. Expanding the definition of a “breach” to include unauthorized “access” to private information, in addition to unauthorized “acquisition” of such information;
  4. Increasing civil penalties for violations of notification obligations; and
  5. For the first time, affirmatively requiring covered businesses to develop, implement, and maintain “reasonable” data security safeguards, which include, among other things, conducting risk assessments and addressing identified risks.

The first four provisions go into effect on October 23, 2019, while the fifth provision requiring companies to adopt and maintain a cybersecurity compliance program becomes effective on March 21, 2020.

Please click here to read the full alert memorandum.

Global Crisis Management Series:  This post is part 6 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

The overall success of an investigation depends on the flow of communications between those overseeing an investigation, those conducting it and the company’s relevant stakeholders.  As such, it is necessary to identify responsibilities and define the structure of communications at the outset of the investigation.  Continue Reading Dealing with an Investigation: Communication