At its simplest, the attorney-client privilege is the protection from disclosure provided, for the benefit of a client, to communications made in confidence by the client to the client's attorney in connection with seeking legal advice. The privilege can be waived by the client, including by failing to maintain the confidentiality of the communications.
In the course of negotiating an agreement for the sale of a private company, it is not uncommon for the company being sold to have many confidential communications with its attorneys. These communications may be seeking advice on such things as negotiating strategy, required disclosures, contingent liabilities, indemnification obligations, potential risks and remedies and the like, and generally would be protected by the attorney-client privilege. What happens to the privilege with respect to those communications, however, when the company is sold? Do the shareholders of the company that is sold have any right to control the privilege? After all, they arguably were the beneficiaries of that legal advice, even though the advice may have been given to the company itself. Indeed, it may be the shareholders who have the most to lose if those protected communications become available to a buyer which believes it has a claim to make against the sellers arising out of the transaction. Or does the privilege, like any other asset of the company, go with the corporate entity to the buyer?
In 2013, the Delaware Court of Chancery, in Great Hill Equity Partners IV, LP v. SIG Growth Equity Fund I, LLP, held that the attorney-client privilege with respect to a merging company's confidential pre-closing communications with its attorneys passed, along with all other rights, privileges, powers and franchises, to the surviving corporation in a merger under Delaware law. The Great Hill court nevertheless gave
Mergers & Acquisitions Whose Privilege Is It? The Attorney-Client Privilege in M&A Transactions ...................................................1
Startups Benefits and Challenges of an Early Stage Biotech Company Going Public ................................................3
Antitrust and Franchise Litigation Update: No-Poach/No-Solicitation Provisions in the Franchise Industry ... ........................5
Privacy Applying EU Guidance on Real-Time Bidding Beyond the GDPR ........................................................8
Tax IRS Issues Proposed Regulations Regarding Withholding Obligations on Transfers of Partnership Interests by Foreign Partners.................11
Recent News & Related Articles
New York SHIELD Act Expands Privacy and Cybersecurity Obligations
Time to Dust Off Your Antitrust Compliance Efforts? Major DOJ Policy Shift Designed to Reward Companies that Do
Ohio Supreme Court Holds 10-Year Construction Statute of Repose Includes Breach of Contract Claims
SEC Proposes Updates to Rules Governing CEFs Illinois Legalizes Recreational Use of Marijuana
Effective January 1, 2020 Converting a Mutual Fund to an ETF: Key
For more details on any of the topics covered in this Business Law Update, please contact the authors via the links at the end of each article or David R. Valz, editor-in-chief. For information on our Corporate Transactions & Securities practice, please contact Frank D. Chaiken, practice group leader.
ATLANTA CHICAGO CINCINNATI
Business Law Update
practitioners a clear path to a different result in the future by noting that the parties to a merger were certainly free to negotiate "special contractual agreements" to protect themselves and prevent the privilege from transferring to the surviving corporation, even though no such contractual arrangement had been present in the Great Hill merger.
In May of this year, in Shareholder Representative Services LLC v. RSI Holdco, LLC, the Delaware Chancery Court further elaborated on just what special contractual arrangements might be employed to prevent the pre-closing attorneyclient privilege from transferring to the surviving corporation in a merger and to assure that the selling shareholders would get the benefit of the privilege for themselves. In the RSI case, the communications at issue consisted of 1,200 pre-closing emails between the company and its attorneys with respect to the transaction that remained on the company's servers after the closing. Following the merger, the buyer sought to use these pre-closing privileged communications in litigation it brought against the selling shareholders.
Presumably heeding the "advice" given by the Chancery Court in the Great Hill decision, the selling company in RSI had negotiated provisions in the merger agreement retaining control of the attorney-client privilege for preclosing communications for the benefit of the selling shareholders. As interpreted by the court, the merger agreement provisions were intended to accomplish four objectives:
preserve any privilege attaching to pre-merger communications as a result of a law firm's representation of the company being sold in the merger;
assign control over the privilege to the post-closing shareholder representative;
require the buyer and the seller to act to ensure that the privilege remained in effect; and
prevent the buyer from using or relying on the privileged communications in post-closing litigation against the sellers.
The buyer made two arguments as to why it was entitled to use the privileged emails. First, the buyer claimed that the provisions in the merger agreement, which applied to
privileged communications, did not apply to the emails because they were no longer privileged, because the sellers had allowed the privilege to be waived long before by allowing the emails to remain on the company's servers, which had been transferred to the buyer in the merger along with the other assets of the company. Second, the buyer also argued that the privilege had been waived post-closing, notwithstanding the restrictions in the merger agreement, because the selling shareholders had failed to act postclosing to recover the privileged emails.
The Chancery Court concluded that it was required to give the "clear and unambiguous" contract language the parties had included in the merger agreement its plain meaning and noted that the provision expressly referred to privileged attorney-client communications between the company and its lawyers prior to the closing, so that even if the privilege was waived post-closing by allowing the emails to remain on the company's computers, the prohibitions on use of the communications negotiated in the merger agreement were valid. The court also found no post-closing waiver of the attorney-client privilege simply because the shareholders had allowed the privileged communications to remain on the company's computers, and noted that the buyer was obligated under the merger agreement to take all necessary steps to preserve the privilege.
Attorney-client privilege "claw-back" provisions have become common in private company merger and stock sale agreements. The Chancery Court's decision in RSI emphasizes the importance of a well-drafted claw-back provision that clearly specifies how pre-closing privileged communications are to be handled. The decision also suggests the importance of not only preserving the benefit of the privilege for the sellers but also expressly prohibiting the buyer from using the communications and requiring the parties to affirmatively act so as to preserve the privilege. These claw-back provisions also commonly include an advance conflict of interest waiver that allows the former company counsel to represent the sellers post-closing in matters arising out of the transaction even though that representation is adverse to the company, their former client.
Please contact Dave Neuhardt with any questions.
Business Law Update
Benefits and Challenges of an Early Stage Biotech Company Going Public
By Faith L. Charles, Paige S. Connelly and Mike Ragan
Initial public offerings (IPOs) have become an increasingly popular way for early stage biotechs, including companies in preclinical development and companies conducting phase one clinical trials, to raise capital and position themselves to successfully execute their development plans and elevate their profiles. There were over 60 biotech IPOs in 2018 alone and the trend continues in 2019, although it is a bit more volatile. An early stage biotech's significant capital needs and growth potential, coupled with the expanding demand for interesting and innovative drugs, technology and health care solutions, make the IPO an attractive alternative to private investment for capital infusion and market visibility.
The considerations for biotech companies contemplating going public do not deviate significantly from the IPO vs. private investment decision in other industries. Some benefits of going public include a much-needed capital infusion; increased ability to attract talented personnel and directors as well as certain institutional investors who invest only in public companies, potentially reducing the cost of capital in future transactions; the enhanced visibility of being publicly traded; and liquidity for investors. Challenges include volatility in the market; the time cost and financial expense associated with conducting an IPO; the regulatory requirements and disclosure obligations imposed upon public companies; the importance of setting and hitting an optimal valuation inflection point; increased scrutiny of clinical and other milestones; and high ongoing compliance costs and time costs following an IPO, including corporate governance obligations, stock exchange requirements, increased legal and audit fees, and investor relations commitment. These are all important factors to consider when assessing financing alternatives.
An IPO is, at its core, a financing event. Bringing a biotech product to market is a lengthy process involving, among other things, significant R&D expenditures, multiple phases
of clinical trials, regulatory submissions, revisions and setbacks, manufacturing lead time for the product, and ability to commercialize a product and gain market acceptance. The amount of time needed to go from clinical trials to commercialization of a final product is not always apparent at the outset, and therefore biotech companies can benefit greatly from cash infusions from an IPO and subsequent financings. That said, an early stage company
must evaluate the substantial time and transaction costs associated with going public. In addition to the cost of legal, accounting and financial advisers, consider whether product development and operations will suffer if management and other team members step away from their day-to-day responsibilities to focus on the IPO process, including dealing with a new, broader investor base and roadshow process. It's important to ask, are there upcoming scientific and clinical milestones that require the attention and expertise of management and key personnel whose time would otherwise be occupied preparing for the IPO?
The regulatory reporting and compliance obligations incumbent on public companies are important factors in any deliberations of IPO vs. private financing. Securities and Exchange Commission (SEC) filings, stock exchange compliance, corporate governance requirements, and the implementation of Sarbanes-Oxley corporate infrastructure and controls are just a few of the regulatory requirements for public companies on a monthly, quarterly, periodic or annual basis. Early stage companies should be aware that these requirements will be an ongoing burden for management, and it is critical to enlist skilled advisers (legal, accounting, regulatory and financial) capable of assisting with compliance and other operational matters.
One benefit of remaining private is that the company reports to a finite group of investors, some of whom are also
Business Law Update
strategic advisers to the company who are aligned with the company's operational goals. Many startup companies benefit from being able to select which investors and investor groups invest in the company, and as long as the company is private, it will not have to change its business plan to satisfy expectations of the Wall Street investor base. Although insider participation in biotech IPOs is high, early stage investors' ownership interests in a company will be diluted following an IPO, and the role of these investors changes as their equity position decreases. Once the company goes public, the management team and the directors must answer to a broader group of investors and will be under pressure to produce short-term results and growth, which might not align with the company's original objectives. This might not be a bad thing though many biotech companies that succeed in the marketplace have a strategy that is quite different from what was originally intended, and benefit from the new cash infusion, new board members, new thought leaders and new investor base related to an IPO. With the uncertainty of clinical trial results, investors are investing in management (and management's ability to change course if needed) as much as they are investing in the company's product or treatment. Public trust of the company becomes key.
Lastly, biotech companies should be cognizant of the timing of a contemplated IPO relative to expected product developments and the increased scrutiny associated with a
public company. As biotech companies anticipate the timing of an IPO, it is important to consider the uncertainties of clinical testing milestones, regulatory hurdles and manufacturing delays which may impact the company's operations and the optimal timing of a financing event. Positive value inflection points in a company's clinical and commercial trajectory provide opportune timing for financing events, particularly an IPO. The arrival of bad news in the lead-up to an IPO can decrease market appetite for the equity and may redirect the company to other financing alternatives.
As the biotech IPO trend continues, it's important for companies in the sector to be aware of the advantages and disadvantages of public securities offerings. While an IPO can provide market exposure and access to significant capital, it can also be a drain on the valuable time and resources of a company time and resources that may be better harnessed developing product and navigating the regulatory landscape of the biotech industry. The decision to go public or to seek private investment should be carefully thought through and always be made with assistance of legal and financial counsel, taking into account the factors above, and examining the particular needs of the company to determine the best course forward.
Please contact Faith Charles, Paige Connelly or Mike Ragan with any questions.
Thompson Hine in the News
Frank Chaiken is quoted throughout "Evolving role of the CFO" in the August 2019 edition of Financier Worldwide Magazine.
David Schwartz is quoted in "CBP Report Shows Spike In Duty Evasion Allegations" on Law360.com. Bibb Strench is quoted in "SEC Weighs Whether to Regulate Facebook's Libra" on the Wall Street Journal site
(subscription required). Sarah Hall, Joe Berger and John O'Hara's article "Preparing for a DoD OIG Audit: DoD's Focus on Small Business
Set-Aside Contracts and Certifications" appears in the July edition of Pratt's Government Contracting Law Report. Kevin Oles and Jim Balthaser's article "INSIGHT: Lease Accounting Changes Present More Than Accounting Problems"
appears on the Bloomberg Tax site. Heather Muzumdar is quoted in "Hiring Tech Has Potential, but Beware Automation Bias" on the SHRM site. Frank Chaiken and Tony Kuhel's article "INSIGHT: M&A Transactions a Natural Fit for Legal Project Management"
appears on the Bloomberg Law site.
Business Law Update
Antitrust & Franchise
Litigation Update: No-Poach/No-Solicitation Provisions in the Franchise Industry
By Jennifer L. Maffett-Nickelman
For regular readers of this newsletter, last summer's edition of the Business Law Update included an article with an introduction to the then-recent elevation of no-poaching and no-solicitation provisions as targets of antitrust enforcement. This article, the first in a series on this topic, will detail the ongoing litigation involving these nopoach/no-solicitation provisions, with a specific focus on the litigation in the franchise industry. Future articles will focus on other aspects of this hot topic as well as updates on pending litigation in and out of the franchise industry and state laws restricting the use of such provisions.
No-poaching and no-solicitation agreements ("no-poach clauses"), which are agreements between companies competing for employees to not solicit or hire the other's employees, are per se illegal under the antitrust laws if they are not reasonably necessary to any separate, legitimate business collaboration between the employers. As the prior article explained, these provisions have always been illegal, but in 2016 and then again in 2018, the Department of Justice Antitrust Division (DOJ) and Federal Trade Commission publicly announced and reiterated their intent to increase enforcement in this area of antitrust law, including pursuing criminal penalties against individuals that participated in these practices.
No-Poach Agreement Litigation
Along with these regulatory warnings has come a wave of litigation. In 2018 the franchise industry in particular became a high-profile target of politicians and class action plaintiffs' lawyers aiming at the common practice of including nopoach clauses in form franchise agreements which, in various forms and degrees, restrict franchisees of a brand from soliciting or hiring employees of locations owned by the franchisor company and/or another franchisee within that brand. The plaintiffs alleged that these provisions
suppress wages and are a primary cause of wage stagnation, at first focusing on lower-level employees in the fast food industry and then expanding to franchises in other industries.
In 2017, McDonald's was the first major franchisor hit with a class action challenging the no-poach clause it used in all of its franchise agreements. Then in 2018, several plaintiff class action lawyers filed multiple actions against various
franchisors, including but not limited to, Burger King, Cinnabon, Dunkin', H&R Block, Jackson Hewitt and Pizza Hut. These complaints seek damages on behalf of employees who claim that they were paid lower wages as a result of the no-poach clauses. While many franchisors have, in response to government actions, agreed to remove the no-poach clauses from their franchise agreements going forward and agreed not to enforce such provisions in existing agreements, the litigation over their past use and legality continues.
Standard of Review The Key Issue
One of the primary issues in these cases is what standard of review should be used to analyze whether a no-poach clause violates antitrust law. To prevail on an antitrust claim, a plaintiff must show an agreement or conspiracy that was an unreasonable restraint of trade under either a per se or "rule of reason" analysis that affected interstate commerce. A determination of what standard of review to apply depends on whether the alleged restraint is horizontal or vertical as well as its substantive terms. A horizontal agreement is between competitors at the same level of the market, where a vertical agreement is between parties that operate at different levels of the supply chain or market.
The rule of reason is the accepted standard of review of an agreement alleged to violate antitrust law. To succeed on a claim under the rule of reason, a plaintiff must show that the
Business Law Update
defendant has market power, which is the ability to raise prices significantly without going out of business. This very high standard is nearly impossible to establish in most cases. However, some restraints are deemed unlawful per se, but these are limited to restraints that have manifestly anticompetitive effects and lack any redeeming virtue. For example, horizontal agreements among competitors to fix prices or divide markets are the quintessential example of restraints that are per se unlawful. One exception, however, is that a horizontal agreement that would otherwise be found per se unlawful would be exempt from this rule if it is ancillary to a separate, legitimate venture between the competitors. This is the ancillary restraints doctrine, which provides that these types of horizontal agreements are subject to the rule of reason.
There is a third standard of review that is considered a "short form" of the rule of reason analysis the "quick look." This approach is available when, as courts have described, "an observer with even a rudimentary understanding of economics could conclude that the arrangements in question would have an anticompetitive effect on customers and markets, but there are nonetheless reasons to examine the potential procompetitive justifications."
Whether a per se or rule of reason standard applies is often the determining factor in an antitrust case. Most plaintiffs in the franchise cases argue that the no-poach clauses in the franchise agreements are unlawful per se or reviewable under the quick look analysis, while the defendant franchisors argue that the no-poach clauses should be reviewed under the rule of reason and, because the plaintiffs in each case failed to allege "market power" of any of the franchisors, the claims should be dismissed.
Some courts have ruled on the motions to dismiss filed by franchisors in these cases, including some rulings on which standard of review should apply. In the McDonald's case, the court held that company-owned locations and franchisees do compete with each other and that, while franchise agreements are generally vertical agreements, the agreements that include the no-poach clause have horizontal elements as well because they restrain competition for employees among horizontal competitors, the franchisees and the company-owned stores. However, the court noted that these restraints, while horizontal, may
be ancillary to otherwise procompetitive agreements and found that, because each new franchise agreement increased the output of the product, it was procompetitive and, therefore, rejected plaintiff's argument that the nopoach clause was unlawful per se.
The court then analyzed whether the plaintiff had plausibly alleged a restraint that may be unlawful under a quick look analysis. Because even "a person with a rudimentary understanding of economics would understand that if competitors agree not to hire each other's employees, wages for employees will stagnate," the court found that plaintiff had done so and denied the motion to dismiss, allowing the case to proceed to discovery. However, the court also warned that the evidence may not actually support a claim for an unlawful restraint under a quick look analysis and noted that plaintiff employees' decision to not plead a claim under the rule of reason was "unsurprising" because that would require them to meet the high standard of showing the defendant, McDonald's, had market power in a relevant market. In addition, the court questioned the viability of the proposed nationwide class, noting that because the jobs at issue are mostly low-skill, the relevant market area is likely to cover only a small geographic area, which would cut against certification of a nationwide class. The court in the Cinnabon case reached a similar conclusion.
The DOJ Weighs In
After the McDonald's decision, the DOJ sought and received leave to file a Statement of Interest in three plaintiff class action cases (consolidated for briefing purposes) in the Eastern District of Washington pending against Arby's, Auntie Anne's and Carl's Jr., asserting what the DOJ believed was the appropriate standard of review in these cases. The DOJ first cites the standard that nearly every vertical restraint should be assessed under the rule of reason and noting that even horizontal agreements that would otherwise be per se unlawful may be permitted under the ancillary restraint doctrine. The DOJ's position is that because the franchisor and franchisee typically conduct business at different levels of the market structure, restraints imposed by the franchise agreement, including nopoach clauses, are usually vertical and increase interbrand competition and, therefore, are reviewed under the rule of reason. The DOJ also acknowledges that some no-poach clauses could be horizontal if the franchisor and franchisee
Business Law Update
compete in the same market for employees, but because the franchise relationship is itself a legitimate business collaboration in which the franchisees operate under the same brand, the no-poach clause would likely qualify as an ancillary restraint and, in such case, would also be subject to the rule of reason. The DOJ also explicitly rejects the application of the quick look analysis because it applies only in rare cases, and no-poach clauses in franchise agreements may provide procompetitive benefits and promote interbrand competition, thus requiring a full rule of reason analysis.
After the DOJ filed this statement, the parties in the Washington cases settled, and those cases were dismissed. The DOJ statement contradicts the holdings by the McDonald's and Cinnabon courts regarding the correct standard of review to apply. It remains to be seen what weight the DOJ's position that the rule of reason analysis should apply to no-poach clauses in franchise agreements
will carry with courts in present and future cases. As some of the courts suggested in their decisions, a finding that a rule of reason analysis is appropriate likely spells defeat for the plaintiffs because of the proof required to establish a violation. This is just one of the issues, along with other antitrust and class certification considerations, that will determine the outcome of these cases and the use of nopoach clauses in franchise agreements going forward.
There is also ongoing litigation of no-poach agreements in contexts outside of the franchise industry as well as government enforcement actions and pending legislation by various states to restrict the use and enforceability of nopoach clauses and agreements. Stay tuned to the next installment of the Business Law Update for more information on this evolving issue relevant to any company with employees.
With any questions, please contact Jennifer MaffettNickelman.
Staying Ahead of the Cybersecurity Curve: Practical Tips from the Experts
Tuesday, September 24 Atlanta
8:30 - 9:00 a.m. Breakfast & registration | 9:00 - 10:30 a.m. Program
Join us for a presentation featuring a cybersecurity expert from Ankura and lawyers from our Privacy & Cybersecurity practice, who will detail how cybersecurity assessments work and provide an overview of the legal issues, including the California Consumer Privacy Act.
Ankur Sheth, Senior Managing Director, Ankura Steve Stransky, Senior Counsel, Thompson Hine Tom Zych, Partner, Thompson Hine
For more information, or to register, please visit ThompsonHine.com/Events.
Business Law Update
Applying EU Guidance on Real-Time Bidding Beyond the GDPR
By Thomas F. Zych, Steven G. Stransky and Mona Adabi
Organizations may rely upon real-time bidding (RTB) for several reasons: to advertise their goods and services to new audiences at a lower cost than traditional advertising campaigns, to more precisely target potential customers who are most relevant to their area of business, or to more adequately measure the success of their products and sales techniques. In fact, according to some estimates, U.S. organizations spent almost $24 billion on advertisements using RTB in 2018, which is more than three times the amount spent just four years earlier.
However, the use of RTB raises data privacy and security concerns, and its practice has been the subject of formal complaints lodged with and ongoing investigations by several EU data protection authorities. The UK's Information Commissioner's Office (ICO) recently stated that current RTB practices are "disproportionate, intrusive, and unfair." The statement was made in a recent report the ICO issued regarding RTB's impact in terms of compliance with the EU General Data Protection Regulation (GDPR).
However, the ICO's findings have broader applicability to U.S. organizations seeking to comply with a range of foreign and domestic data protection laws, including the California Consumer Privacy Act (CCPA). Most importantly, the ICO's findings address consent and lawful data processing, transparency and data privacy notices, and vendor management and third-party contracting.
What Is Real-Time Bidding?
RTB often refers to the automated process triggered when an individual accesses a website or an online application and a range of user data, including personally identifying
According to the ICO, most bid requests include (but are not limited to) the following types of data:
A unique identifier for the bid request
The user's Internet Protocol (IP) address and cookie and user identification
The user's location, time zone, language preference and device type
The ICO noted that some bid requests contain information on the user's website history, use of the current website or application, search queries, session time and demographic data. It also found that the underlying RTB protocols relate to categories of data that are deemed "special" under the GDPR because of their sensitivity (e.g., mental and sexual health, politics, ethnicity). Generally, an advertiser will pay a publisher more for a bid request with greater specificity and detail because it will enable the advertiser to more accurately target an advertisement, especially if it supplements such a bid request with information from other sources.
Data Protection Compliance
Business Law Update
2003, which implements European Directive 2002/58/EC (also known as the "e-privacy Directive"). As noted above, there are three aspects of the ICO's report that are relevant to any organization seeking to comply with data protection laws and industry standards: consent and lawful data processing, transparency and data privacy notices, and vendor management and third-party contracting.
Consent and Lawful Data Processing
A cornerstone of the GDPR is that organizations are required to identify a lawful basis for their data processing activities, and it sets forth six such bases for processing personal data. When processing "special categories" of personal data, organizations have to account for additional requirements set forth under the law. The ICO reported a "lack of clarity" regarding the appropriate lawful basis an organization should rely on to undertake its data processing when it pertains to RTB. In short, the ICO concluded that in order to account for both (i) the processing of general and special categories of personal data under the GDPR, and (ii) cookie and similar data under the PECR, the "only lawful basis for `business as usual' RTB processing of personal data is consent." This conclusion is significant because it rebuts the argument that organizations can rely on the GDPR's "legitimate interest" legal basis for data processing, which arguably has a lower threshold than obtaining an individual's consent.
In addition to its impact on organizations under the GDPR, the ICO report highlights the importance that consent may have on organizations' compliance with other data protection laws. For instance, in the United States, the Children's Online Privacy Protection Act (COPPA) requires organizations to obtain parental consent before collecting some types of information from children under the age of 13, and the CCPA (as currently written) requires covered businesses to obtain similar consent prior to selling children's personal information and prohibits such businesses from entering "consumers" into their financial incentive programs unless the "consumer gives the business prior opt-in consent ... which clearly describes the material terms of the financial incentive program, and which may be revoked by the consumer at any time." The Illinois Biometric Information Privacy Act (BIPA) requires organizations to obtain consent when collecting or disclosing individuals' biometric information. In addition, the Federal Trade
Commission has issued recommendations that organizations provide consumers with notice and obtain their affirmative consent before using data in a way that is materially different than claimed when collected.
Transparency and Data Privacy Notices
The ICO report raises concerns about how the principle of transparency is addressed in the RTB context. The GDPR mandates organizations to process personal data in a "transparent manner," which, accordingly, requires organizations to provide individuals with notice of their data processing activities. More specifically, Article 13 of the GDPR requires that at the time personal data is obtained, an organization must provide the individual whose personal data is being disclosed with a broad range of information, such as:
The organization's contact details
The purpose of and legal basis for the data processing
The recipients (or categories of recipients) of the personal data
Whether the organization will transfer personal data outside the EU
Data retention periods and criteria
The individual's rights under the GDPR
Article 14 of the GDPR sets forth similar requirements in the context of when an organization collects personal data from a third party (and not the individuals themselves). Recital 39 of the GDPR explains that "[t]he principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used" and individuals "should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data." The ICO report is critical of the manner in which organizations address these transparency-related issues in the RTB process. In particular, the ICO report raises concerns that publishers cannot always identify the third parties with whom they share personal data and the nature in which personal data is consistently augmented, both within and outside of the RTB process.
The issue of transparency is a hallmark of many data protection laws, including those in the United States. For
Business Law Update
Vendor Management and Third-Party Contracting
The ICO report notes that a single RTB request can result in an individual's personal data being processed by hundreds of organizations that have no direct relationship with that individual. The nature of the processing in the RTB ecosystem leads to the risk of "data leakage," which the ICO defines as the circumstances "where data is either unintentionally shared or used in unintended ways." The ICO report also raises concerns that under such circumstances, there usually are no robust guarantees or technical controls between all the parties to mitigate the risk of a data leakage. Although contractual terms are an important part of data processing between parties, the ICO emphasizes that organizations "cannot rely on standard terms and conditions by themselves, without undertaking appropriate monitoring and ensuring technical and organizational controls back up those terms."
The ICO raises three important points that all organizations should consider incorporating into their own vendor management process that involves the exchange or processing of personal data, confidential information or other sensitive business data. First, assess whether vendors have the competency to process this information in accordance with the law and industry standards. Second,
prior to any exchange of data, a written contract should be executed that memorializes the vendor's security standards; data assistance, confidentiality and breach notification requirements; and liability and remedies. Third, depending on the nature of the processing, the organization should provide meaningful oversight of the vendor to ensure its ongoing compliance with the contract. Given the degree to which organizations routinely disclose personal data, confidential information and other sensitive data with external entities, a vendor management contracting process has become a standard business practice.
The ICO report raises several data privacy issues in the RTB context that transcend the GDPR and provide insights into complying with multiple data protection laws. For example, it is important for an organization to fully understand the type, nature and scope of data it collects as part of its routine business practices from cookie data on its website users to general personal information on its rewards program members to truly recognize its legal obligations related to such data processing, which may include requesting and obtaining an individual's consent.
An organization should also be cognizant of its third-party and vendor management contracting to mitigate the risk of data leakage by ensuring proper technical controls are in place amongst the parties. Not only does third-party contracting protect personal data rights, it protects a business's interests and can mitigate legal liability.
With any questions, please contact Tom Zych, Steve Stransky or Mona Adabi.
Business Law Update
IRS Issues Proposed Regulations Regarding Withholding Obligations on Transfers of Partnership Interests by Foreign Partners
By James C. Koenig, Alexis J. Kim and Kevin R. Tabor
Parties to an acquisition of a partnership or LLC may have noticed an additional form or certification of nonforeign status in closing documents signed since the 2017 enactment of the Tax Cuts and Jobs Act. The IRS recently issued Proposed Treasury Regulations on this new withholding rule giving practitioners more guidance on what IRS forms and certifications will be available to avoid an additional tax withholding.
In addition to withholding under the Foreign Investment in Real Property Tax Act (commonly referred to as FIRPTA), new withholding rules under new Section 1446(f) now require an additional 10 percent withholding on transfers of partnership interests by foreign partners ("Section 1446(f) withholding"). Most transactions involving the sale or transfer of a partnership interest (or LLC membership interest taxed as a partnership) will likely require both a FIRPTA certificate and an IRS Form W-9 in order to avoid both Section 1446(f) withholding and FIRPTA withholding. The new rules also require a buyer to provide a continuing partnership with a certificate in order to avoid additional Section 1446(f) withholding on future distributions from the partnership.
The following describes common issues that may arise in transactions due to the new Section 1446(f) withholding rules and their interaction with FIRPTA.
With regard to FIRPTA withholding, 15 percent withholding is required on any disposition of a U.S. real property interest by a foreign person. To avoid FIRPTA withholding, FIRPTA certificates can be provided either to indicate that the transferor is non-foreign or that the interest is not a U.S. real property interest. Under the new rules, in certain circumstances, an IRS Form W-9 can qualify as a valid FIRPTA certificate certifying that the transferor is not a foreign person.
The Section 1446(f) withholding rules provide that the 10 percent withholding generally applies to sales of partnership interests (or membership interests of an LLC taxed as a partnership) by foreign partners where such partnership is engaged in a U.S. trade or business. This new Section 1446(f) withholding requirement is separate from FIRPTA and has different exceptions and certificates.
To avoid Section 1446(f) withholding, in the case of a selling partner who is a U.S. person, such selling partner must provide a valid IRS Form W-9.
In the case of a selling partner who is a foreign person, Section 1446(f) withholding will be required unless a limited exception applies.
If there is a continuing partnership, the buyer/transferee is also required to provide a certificate to the continuing partnership within 10 days of the closing of the sale of the partnership interest indicating whether it withheld and if not, the exception it relied on to not withhold. If this certificate is not provided, the new rule requires the partnership to withhold on future distributions to the buyer/transferee.
Any partnership with a foreign partner will be required to withhold on distributions to such foreign partner that exceed such partner's tax basis in such partner's equity interest in the partnership.
Separate proposed rules apply with respect to publicly traded partnerships.
With any questions, please contact Jim Koenig, Alexis Kim or Kevin Tabor.