Proposed Bills Highlight Legal Risks of Sexual Misconduct Claims

In the current climate of sexual harassment incidents being reported in a variety of industries across the country, organizations and their legal departments should be reviewing legislation and considering their legal risks, should they need to defend against sexual harassment or misconduct allegations.

Just this month, in fact, legislation was proposed at state and federal levels to keep employers from trying to silence accusers following mediation and settlements. The

Sen. Kirsten Gillibrand (D-N.Y.)

Huffington Post reported that the bipartisan legislation from Sen. Kirsten Gillibrand (D-N.Y.) and Rep. Cheri Bustos (D-Ill.) would ban employers from holding employees to forced arbitration clauses, which often prevent sexual misconduct survivors from speaking publicly about abuses in the workplace.

Similarly, legislation targeting nondisclosure agreements was recently introduced by state officials in New Jersey, California, New York and Pennsylvania to their respective legislatures. These involve standard confidentiality contracts that companies use in the event of a lawsuit so that the terms of a settlement do not become public knowledge. Depending on if, and with what wording, these bills are passed it will almost certainly affect companies’ and leaders’ policies and behaviors.

Linda B. Hollinshead, a partner in the employment law practice of Duane Morris told Risk Management Monitor that if confidentiality cannot be guaranteed during a settlement, there could be less mediation and arbitration and more courtroom battles as a result.

“If these bills are passed into law, I will be curious to see how employers change the way they handle these issues—because one of the things you hope to buy when you settle, is quiet,” said Hollinshead. “I would presume that if this is the direction in which things are going, employers may become increasingly more vigilant on preventing [misconduct] in the first place.”

Regarding the New Jersey legislation, advocates seem to be pleased with the bill’s introduction but do not disregard the value confidentiality can provide for a victim of sexual misconduct.

“While we are in favor of the intent of the bill, we do want to make sure survivors have the option to confidentiality,” said Patricia Teffenhart, executive director of the New Jersey Coalition Against Sexual Assault. “Many survivors might wish to engage in a nondisclosure agreement, and we need to expand the opportunity for them to have the option to pursue nondisclosure.”

According to XpertHR’s Top 15 Most Challenging HR Compliance Issues for 2018  small, medium and large employers across the country expect sexual harassment to be a top matter of urgency moving forward. The report reminds that misconduct can occur between co-workers, both in and out of the workplace:

Harassment also may involve a wide variety of conduct—physical, written or verbal, as well as conduct over the internet and social media including cyberbullying.

For more legal risks to consider, visit www.rims.org to download the new RIMS Professional Report, The Top 8 Legal Developments You Need to Know About in 2017.

Using ERM to Protect Your Business from The Equifax Fallout

As with many data breaches, the general conclusion of the Equifax attack is that personnel were not aware of the issue beforehand. This conclusion, however, is false.

In early September, I anticipated that a vulnerability in Equifax’s software was known ahead of time, and that this scandal was, therefore, entirely preventable. A month later, the NY Times reported that the Department of Homeland Security sent Equifax an alert about a critical vulnerability in their software. Equifax then sent out an internal email requesting its IT department to fix the software, but “an individual did not ensure communication got to the right person to manually patch the application.”

The Equifax data breach was a failure in risk management. As a credit bureau that deals with the personally identifiable information (PII) of 200 million U.S. customers, Equifax has a legal and moral responsibility to safeguard their customers’ security, and to adopt the proper systems to do so.

For instance, if Equifax had an enterprise risk management (ERM) system in place, the warning from Homeland Security would have been properly recorded and assigned out to the appropriate personnel. This system would have provided transparency over the status of the task in progress, and would have triggered reminders until the vulnerability was patched and verified by the right subject matter expert.

A Point of No Return

It’s my opinion that this scandal is a point of no return for risk management. While data breaches have abounded in recent years, there has never been one of this magnitude or one that provides every piece of information hackers need to steal our identities. Of course, lawsuits and penalties are piling up around the company’s negligence, but these financial losses are nothing compared to the reputational damages Equifax will suffer—shares fell by 18% following the breach and have yet to fully recover.

What makes this scandal so unique, and therefore a point of no return, is that these reputational damages reach far beyond Equifax. Consumers can’t always choose whether they’re a customer of Equifax, but they can choose whether to do business with the institutions that gave away their information to Equifax in the first place.

I also believe that consumers’ outrage with this scandal will cause them to shift their money, loyalty, and trust to institutions that can demonstrate effective risk management. CEOs and boards of every company will have to prove their organizations have adequate enterprise risk management systems in place. They’ll find that more effective risk management and governance programs are necessary to keep their market shares up and their reputation clean.

Where to Go from Here

While this breach may appear to be an event of the distant past, we are in the eye of the storm. Stolen information can lie dormant for months or years as criminals wait to make their move, and when they do, you’ll have either taken this period of calm as a chance to forget the scandal, finding yourself ill-prepared, or a chance to get to higher ground, finding yourself fully protected.

To protect themselves, businesses must:

  • First, to determine where to focus your security resources, recognize that people, processes, and procedures are now the biggest risks. Businesses need to perform risk assessments across all departments to determine who has access to sensitive information and authentication processes, and what the business impact would be if these employees were to be impersonated.
  • Next, to address these risks, businesses must rewrite their procedures for authenticating the people involved in sensitive requests and actions both verbally and electronically. With so much PII now in the public domain, it is no longer safe to rely on traditional authentication based on these pieces of information. For example, the security question “What was your first car?” is not effective because the answer is now easily accessible. A more effective question would be “Who was your best friend in elementary school?”
  • Finally, it is important to keep your third-party vendors in mind. Vendors often have access to sensitive information and processes, which could have an enormous impact on your company. It is crucial, therefore, to extend your internal authentication procedures out to your third parties so that they are authorizing sensitive requests and actions as securely as your own organization.

Our world, including the business world, is becoming increasingly transparent, meaning it’s up to you to act with integrity and protect your stakeholders. Keeping the Equifax data breach in mind, along with enacting these tactical steps, will help you stay ahead of the competition and out of glaring social media headlines.

Awful but Lawful: Attorney Fee Provision Gone Bad

Companies that sign contracts, including renewals, without careful review could be in for an unpleasant surprise if the unexpected happens. For example, extra caution would have saved “Widget Corp.” a lot of money and time in its dispute with “Acme Inc.”

Here’s the scenario: Widget Corp. enters into a contract with Acme Inc. While Acme Inc. expects to earn more than a million dollars from the contract, Widget Corp. later closes its doors after selling most of its assets. Angered and disappointed, Acme Inc. decides to sue Widget Corp. over the contract even though it has a weak claim that Widget Corp. did anything wrong.

The risk is that, perhaps recognizing it will lose on its breach of contract claim, Acme Inc. points to a peculiar provision in the contract that, in a nutshell, requires Widget Corp. to pay Acme Inc.’s attorney fees—win or lose. (Can you guess which company drafted the contract?)

The result: At arbitration, a respected arbitrator hears arguments on the contract dispute and concludes that Widget Corp., in fact, had done nothing wrong and had not broken its contractual promises to Acme Inc. The arbitrator, nonetheless, required Widget Corp. to pay Acme Inc.’s attorney fees incurred in litigating the dispute—those fees exceeded $150,000.00.

Widget Corp.’s counsel raised a number of defenses:

  1. As a general rule, courts won’t interpret contract provisions in such a way that creates absurd or unreasonable results. Widget Corp.’s counsel argued that it would be absurd if Acme Inc. could sue Widget Corp., lose all of its arguments, but still collect attorney fees.
  2. Attorney fees aren’t typically awarded unless the side getting the attorney fees wins at least part of the dispute. This is so because courts view attorney fees as a form of damages, and if the other side did nothing wrong, then there is no damage to award—including attorney fees.
  3. An attorney fee award must be “reasonable.” Widget Corp.’s counsel argued that it is unreasonable to award any attorney fee whatsoever given that Acme Inc. lost the entire dispute.

The arbitrator found these arguments unpersuasive and enforced the contract as written. Since the contract said what it said, at the end of the day Widget Corp. signed the contract. As the arbitrator aptly quipped, the provision was “awful but lawful.”

Lessons:

  1. Companies must read contracts carefully to understand what they mean. Companies may be particularly tempted to sign without internal or legal review when renewing an annual or semi-annual contract; companies sometimes assume that the renewal contract will contain the identical language, and the companies do not want to spend additional time or money to review what has already been reviewed. Nothing guarantees that next year’s contract will match the current contract, however. Companies are thus wise to review even renewal contracts to ensure they understand the terms, exposure and risks.
  2. Get a second (and even third) set of eyes on the contract before signing. Companies would be prudent to devote even more resources to reviewing contracts that impose more liability. The rub is that companies often do not comprehend their contractual exposure until multiple people review the contract.
  3. Assume the worst when it comes to a particular, seemingly unreasonable contractual provision. In other words, assume the provision will be enforced as written. Reasonable minds can differ as to what constitutes a “reasonable” provision and it is foolhardy to assume that a court or arbitrator will disregard what parties agreed to—particularly when those parties are businesses.
  4. Remember, if a provision seems questionable in what it purports to do, it is easier to request that the other side remove the provision before you sign than to ask a court or arbitrator to ignore the provision despite your agreement. As Benjamin Franklin once advised fire-threatened Philadelphians, an ounce of prevention is worth a pound of cure.

RIMS Legislative Summit 2017: Focus on Flood

WASHINGTON—The RIMS Legislative Summit kicked off on Wednesday in Washington, D.C. with a panel lead by Congressional office staff.

Panelists included: Democratic Staff in the U.S. House of Representatives; Jason Tuber, Senior Advisor to Senator Menendez (D-NJ); Ed Skala, Deputy Staff Director for the House Financial Services Committee; and Brandon Beall, Professional Staff Member, Office of Senate Committee on Banking, Housing and Urban Affairs; as well as Lisa Peto, chief counsel for the Financial Services Committee.

The focus was the once-again looming expiration of the National Flood Insurance Program (NFIP). The program that was set to expire in September, but was saved with a temporary extension now set to expire again on Dec. 8.

The panelists, each of whom began with the disclaimer that these were their opinions and not the opinions of their office, came to a consensus that a new NFIP was critical, that a gap in coverage is certainly not ideal and they acknowledged that their offices were working on a bi-partisan resolution.

Some of the major concerns discussed were:

  • Funding—who will fund the NFIP? If the NFIP expires or ceases to exist would the burden fall on the taxpayer and then ultimately on government anyway? Should excess flood coverage be privatized? There was also discussion on whether mandating states to offer certain protections for flood exposure would help the situation.
  • Accessibility and Affordability—what measures must be included in the new bill to not only make sure flood insurance is available but that it is available at an affordable price?
  • Residential vs. Commercial—The idea was discussed as to whether there should ultimately be two versions of the NFIP that separate residential and small businesses from large commercial businesses. It was noted that large commercial businesses might have flood coverage elsewhere or are better funded to retain some risk and, as such, should have the opportunity to opt out. This would spur new challenges to determine what qualifies a business as small or large (i.e., an online enterprise that generates considerable revenue but operates out of someone’s basement).
  • Risk Mitigation—Should risk mitigation be a part of the final bill? Incentives for both the insurer and the insured would support organizations that practice good risk management. The argument was made, however, that not all residents and not all businesses have the funds for risk management. For example, not everyone has the money in the bank to raise the height of a house or storefront.

Jim McIntyre, RIMS Washington, D.C. counsel and chair of McIntyre & Lemon stated, “It is probable that we’re looking at another extension come December. Unfortunately for the National Flood Insurance Program, bills regarding trade, healthcare and immigration will take precedent at the moment and [the NFIP] might have to wait a bit longer.”

On Day two of the summit, about 50 RIMS members descended on Capitol Hill for meetings with congressional leaders. The goal was to share RIMS priorities for a long-term National Flood Insurance Program.