The purchase of commercial general liability and umbrella insurance policies are ways to protect your business from liability. However, these types of policies have not adapted to protect policyholders from certain types of cyber liability.  This issue was recently exposed in a case against Urban Outfitters, Inc., and its subsidiary, Anthropologie, Inc. (collectively “Urban Outfitters”). Urban Outfitters found itself with no suitable insurance coverage when facing several lawsuits for privacy infringement that resulted from credit card transactions. Many businesses collect customer data and infringements of customer privacy may not be covered by traditional insurance policies. Do you run a business that collects consumer data? Are you unsure how far your insurance coverage extends in protecting against consumer data breaches? If so, then you may contact us to speak to an attorney about whether you should obtain cyber liability insurance.

What Was the Issue in the Urban Outfitters Case?

In OneBeacon America Insurance Company v. Urban Outfitters, et al., Urban Outfitters was sued in three different states for consumer privacy breaches. Urban Outfitters was sued because of its practice of collecting consumer zip code information when processing credit card transactions. This practice violated multiple consumer privacy laws. Urban Outfitters then looked to its insurance company to defend the multiple lawsuits. However, the insurance company claimed that its general liability policy did not cover that kind of privacy breach. The federal court in Pennsylvania agreed, and held that the insurance company was not obligated to defend Urban Outfitters in any of the lawsuits. The general liability policy only covered “oral or written publication of material that violates a person’s right of privacy,” and even though Urban Outfitters violated consumer privacy, it never published that material.

Peer-to-peer networks have provided an invaluable service that allows users to share information and data around the world. These networks became popular for media sharing, culminating in the infamous Napster scandal. Many are aware of the copyright issues that arise with the use of peer-to-peer media sharing. However, there are other cyber-crime issues that users may expose themselves to when using these networks. Peer-to-peer networks may be used in a variety of legal ways, but users must protect themselves from cyber crime prevalent over these networks. Are you developing or using a peer-to-peer network? If so, then you should be aware of the cyber crimes that you may be exposed to or unintentionally committing.

What is a Peer-to-Peer Network?

A peer-to-peer network is created when two or more computers connect and share resources without going through a separate server.  Typically, peer-to-peer networks are accessed through free software that allows the user to find and download files on another user’s computer.  The traditional computer network uses a client and server model, in which the client computers store and access data on a dedicated server. Peer-to-peer networks move away from the dedicated server. So, each computer is a client and a server. This empowers each user to access and share information directly instead of through a central hub. These networks also provide users with more control. Users can decide to which computers to connect, what files to share, and how many system resources to devote to the network.  Users have many controls over a peer-to-peer network.  However, the average user may expose himself to committing and being the victim of cyber crimes if he does not know how to control the network settings.

The writing is on the wall.  The future of television and media consumption is moving away from network channels and physical sales to an “On-Demand Internet” streaming model.  This trend has already begun with millennials.  Millennials, as a group, do not subscribe to cable television or purchase music. Instead, services like Netflix, Hulu, and SoundCloud provide Millennials with On-Demand access to television shows, movies, and music. Television networks and traditional media companies must adjust to this new trend. This issue recently came to a head in the Supreme Court’s decision in ABC v. Aereo. The Court’s decision, while resolving the immediate issue in the case, has caused a problem in the larger scheme of things. The decision has put a new spin on how the Court applies the Transmit Clause of the Copyright Act of 1976. If you provide digital media content through Internet streaming or access content through the cloud, then the Aereo decision could affect you.

What Was the Issue In ABC v. Aereo?

Aereo is a company that provides a small device that a user can connect to a computer for a monthly fee. The device allows the user to pick up network television broadcast signals and stream them directly to the user’s computer.  ABC and other network broadcasters sued Aereo for copyright infringement. The issue in the case was whether Aereo’s device fits under the definitions of performance and public transmission within the Transmit Clause of the Copyright Act of 1976.  The Transmit Clause describes the exclusive right to “transmit or otherwise communicate a performance . . . of the [copyrighted] work . . . to the public by means of a device or process . . .”  The Court held that Aereo did transmit ABC’s performance and that the transmission was to the public.  Therefore, Aereo infringed upon ABC’s copyrights.

In recent times, a significant amount of business is conducted online.  The Internet connects a business to customers anywhere in the world. What happens when a dispute arises between a business in one state and a customer in another? If the customer wants to bring legal action against the business because of a transaction that occurred online, where does the customer file the action? The answer may depend on the type of website. The courts have created the distinction between active and passive websites. When a transaction occurs through an interactive website, the business may be subject to the jurisdiction of the state where the customer accessed it. Is your business developing a website? Did you know that an interactive website may subject you to the jurisdiction of any state? If so, then you must understand the difference between active and passive websites, and how they may affect your legal rights.

What Is the Active and Passive Distinction?

An interactive or active website is one where business transactions can occur through the website or information can be exchanged to solicit business. On the other hand, a passive website is one that is used to post information for potential customers, but it does not allow for interaction. A passive website is similar to an advertisement. The distinction is crucial because courts will confer personal jurisdiction over companies that maintain active websites in the state where the consumer is located. Active websites include sites that foster online sales, sites that take measures to solicit business in a particular forum, and the use of a third-party site to sell an item. Not every website fits neatly into these two categories, and issues arise when the website falls between the two.

Since the 1930s, the act of publicly raising money for a startup business has been outlawed. Now, with the implementation of the Jumpstart Our Business Startups Act (“JOBS Act”), in 2012, public crowdfunding is legal and encouraged. Startup companies are no longer confined in the resources and opportunities available to raise capital. Private companies can now publicly advertise that they are raising capital and collect investment funds through online crowdfunding services. The JOBS Act allows for two different ways in which a company can utilize this new crowdfunding opportunity. Is your startup looking for an infusion of capital? Are you considering crowdfunding as an option? If so, then you must understand how Title II and Title III of the JOBS Act apply to your startup.

What is Title II?

Title II of the JOBS Act now allows a private company to solicit and advertise investment opportunities to the general public. But, Congress left it up to the Securities and Exchange Commission (“SEC”) to regulate the rules. The SEC has changed Rule 506 of the Securities Act of 1933 to allow for this new public advertising provided that, “the issuer takes reasonable steps to verify that the investors are accredited investors.” Rule 501 defines accredited investor in three different ways: (1) an individual whose net worth or joint net worth with a spouse exceeds $1 million; (2) an individual with an annual income more than $200,000; or (3) a joint annual income with a spouse over $300,000. In addition, issuers must previously file with the SEC that they are claiming this new public solicitation exemption. The penalty for not following these requirements is being banned from fundraising for a year.

In recent years, social media has allowed users to instantly communicate with each other. Social media also provides a low cost and high-yield forum for communications. Because of these effects, social media is becoming the preferred way for advertisers to reach customers. A marketing campaign that includes social media can greatly enhance a company’s brand exposure.  However, there are several legal and regulatory issues that arise when using social media for advertising. When using social media tools like hashtags and facebook pages, advertisers should monitor their copyrights and trademarks and comply with state and federal regulations.  Is your company beginning a new social media advertising campaign? Are you trying to brand your company with hashtags and handles?  If so, then you should contact us to discuss the legal issues.

What is a Hashtag and How Is It Used in Advertising?

A hashtag is a form of metadata made up of a word or phrase that is prefixed with the symbol “#” used by a social media site to create a searchable keyword. Hashtags are commonly used to direct potential customers to others discussing the same hashtag. Any user could create a hashtag with your company’s name or one that infringes on your intellectual property. Most social networks have policies that prohibit trademark and copyright infringement. Be sure to check these policies and the procedures for reporting abuses. Yet, not every third-party use of a trademark is necessarily an infringement if done under the fair-use standard. If a third-party is using a hashtag or handle that refers to your trademark, it may not be an infringement if used only to join a conversation, and that user is not claiming to be the owner of the trademark. Further, you can actually trademark a hashtag with the United States Patent and Trademark Office for additional protection. A mark including the “#” symbol can be registered as a trademark if it functions as an identifier of a good or service.

It seems that entrepreneurs do not simply want to capitalize on local markets anymore.  An international impact is achievable with the connections available through internet and technology (e.g., e-commerce).  A startup company can now achieve that international presence by utilizing cryptocurrencies and crypto-crowdfunding.  Using cryptocurrencies allows a company to do business in any country without worrying about foreign exchange fees or limitations.  Crypto-crowdfunding can help a new company raise capital by creating its own currency in exchange for real money or other cryptocurrency. Are you starting an online business and want an international presence? Do you want to raise money fast for your new company? If so, then cryptocurrencies and crypto-crowdfunding may be helpful.

What is Cryptocurrency?

Cryptocurrency is digital or virtual currency that uses cryptography as its security. These currencies are not issued by central banks, and therefore, immune from government intervention and manipulation. Because there is no government intervention into these crypto-markets, many national cyrptocurrencies are beginning to emerge. European countries with struggling central banks and economies are experiencing the emergence of national cryptcurrencies, such as Spaincoin in Spain and Aphroditecoin in Cyprus. These currencies are easily traded and provide entrepreneurs with the ability to circumvent foreign exchange controls. Whether these currencies are privately started or nationally motivated, they can connect people anywhere in the world while keeping governments out of the picture.

In the past, to start a business you had to find a location, rent space, and open your doors to the public. Today, many entrepreneurs can do it all online by advertising, communicating with customers, and managing transactions using the web. Many entrepreneurs are interested in starting a new business with a strong online presence. There are several steps that one must take to start a business, plus additional considerations to comply with online business laws. Are you ready to create an online business? Are you unsure which laws you need to be aware of for your e-commerce website?  If so, then you need to know the process to start a business and the additional issues that apply to e-commerce.

How Do I Start An Online Business?

The Small Business Administration recommends a ten-step process to start a new business.  First, write a business plan.  This is your general outline as to the identity of your new company and the structure you are going to build to execute your plan.  Second, get the proper assistance and training. No one knows everything and connecting with mentors and experts can help you get off on the right foot.  Third, choose your location. If your company is 100% online, you still need to determine the types of customers you plan on attracting and to what areas you plan on making deliveries.  Fourth, finance your business. Whether you choose traditional financing from a commercial bank or more creative methods (e.g., crowdfunding), make sure to do your research and figure out what works for your company.  Fifth, determine the legal structure of your business. There are many types of entities you can create (e.g., LLC or Corporation). Each entity creates different levels of liability and tax obligations.  Sixth, register your business name with the proper state agency (e.g., Secretary of State).  Seventh, get a tax identification number (a/k/a EIN) by registering with the Internal Revenue Service.  Eighth, register with state and local tax agencies (e.g., Franchise Tax Board, a/k/a FTB). In general, each state has its own tax laws, so make sure you know the obligations within your state.  Ninth, obtain business licenses and permits.  You should keep in mind that state and federal agencies may require different licenses and permits. Finally, you may need to hire employees or independent contractors.

As mobile technology improves, we all do more on our mobile devices—e.g., banking, shopping, and gaming are just a few examples.  The Wall Street Journal estimates the mobile apps market as a $25 billion industry.  New businesses and entrepreneurs may want to jump into this growing market. When new developers enter the market they must consider the privacy rights of users.  The law protects consumers and their privacy from intrusion, and there are even stricter guidelines for apps used by children.  Are you interested in starting a mobile app business?  Are you ready to begin marketing your new mobile app?  If so, then there are steps you must take to ensure you are in compliance with the law and respecting the privacy rights of your customers.

What Is a Mobile Application?

A mobile application is software that can be downloaded and accessed using a mobile device, such as a smartphone or tablet. Apps can be paid or free.  Developers of free apps usually make a profit through advertisements, in-app purchases, and/or paid versions that offer more features than a free trial or “lite” version. Further, apps may collect data from the user.  Apps can access a user’s contacts, call logs, internet data, calendar, and device location.  Usually, this data is collected so that the app can perform what it is designed to do, such as make a bank transfer or direct the user to a destination through GPS.  Data collection must conform to consumer protection guidelines and developers will be held responsible to those guidelines.

Today, most companies are dependent on technology and their computer systems, and there are entities whose primary focus is to hack into these systems. On the other hand, a company might experience an internal breach of its network system, which causes the unauthorized release of sensitive information. Any breach into or out of these systems could be catastrophic. The computer network for a company may contain important data, intellectual property, and consumer information. All industries are susceptible to a data breach. To help protect against these risks, companies must insure themselves with the correct policy. Traditional insurance policies may not be enough to cover all the risks. In recent years, insurance companies have begun to issue specific cybersecurity policies. What kinds of claims are covered under these cybersecurity insurance policies? How can an insurance company ensure that it is mitigating its own risks in underwriting a cyber policy? If you are concerned with these questions, then the effectiveness and scope of these cybersecurity policies is relevant to your company.

What Is Cybersecurity Insurance?

Cybersecurity insurance is an insurance policy that helps mitigate the risks posed by incidents such as “data breaches, business interruptions, and network damages.” The market for this kind of policy is still in development, and insurance companies and consumers are unsure how far reaching the policy protections are. Department of Homeland Security has stated that a more developed cybersecurity insurance market would lead to fewer successful cyber attacks—i.e., by implementing preventive measures in conjunction with policies and lowering premium prices based on the level self-protection. There are steps that companies and individuals can take to reduce their risk level to a cyber attack, and these steps may actually help prevent attacks. Preventive measures can at least lower the risk an insurance company must take in underwriting a cyber policy.