CALIFORNIA LAWYERS ASSOCIATION PWG: Proposed California Consumer Privacy Act Regulations – COMMENTS

Hello Again, All:

Last week, on Twitter, I promised to try to post the California Lawyers Association Privacy Working Group’s comments on the California Consumer Privacy Act.  I made it.  Before you skip directly to the comments, I wanted to briefly discuss my specific role and also make a suggestion (it’s my blawg, so I get to do that!)

My colleagues are attorneys who immersed themselves in technology and the law.  In my case the opposite is true.  I’m a technology professional who passed the California Bar when I was 44 years old (2007, for the curious).  As such, I became the ‘roving technology consultant’ on the various aspects of this law.  In short, I worked with several of our writing subgroups to identify where the concepts in the law don’t mesh with how the technology actually works.

Aside from some minor formatting differences between WordPress and the original – plus some bolds and one URL added by me – these are verbatim comments.

The suggestion?  While you may discern most of the original issues via the comments alone, it would be best to review the proposed regulations that these comments address.

Estimates are that implementation of CCPA may cost $55 billion – and it does not exclusively apply to California companies – so, we understand and appreciate your interest in being well-informed.

Best wishes for the holiday season and the adventure that awaits us in 2020!

Perry

**************************************************************************

December 6, 2019

Privacy Regulations Coordinator

California Office of the Attorney General

300 South Spring Street, First Floor

Los Angeles, CA 90013

Email: PrivacyRegulations@doj.ca.gov

Re: Proposed California Consumer Privacy Act Regulations

Dear Attorney General Becerra:

The California Lawyers Association (“CLA”) Privacy Working Group (“PWG”) respectfully submits these comments on the proposed California Consumer Privacy Act (“CCPA”) regulations. The PWG is a multidisciplinary group with members drawn from various sections of the California Lawyers Association, including: Antitrust, UCL and Privacy; Business Law; and Intellectual Property Law. Our members have broad-ranging expertise in areas that include consumer privacy, cybersecurity, and data protection, and extensive experience with related regulatory, transactional, and litigation matters.

The Attorney General released these proposed regulations for public comment on October 10, 2019. The regulations are intended to operationalize the CCPA and provide clarity and specificity to assist in the implementation of the law. The CCPA requires the Attorney General to adopt initial regulations on or before July 1, 2020.

The PWG applauds the Office of the Attorney General for engaging in a broad and inclusive rulemaking process, including public forums. This public comment period is important because the stakes are high. According to estimates in the Standardized Regulatory Impact Assessment for the CCPA regulations, published by the Berkeley Economic Advising and Research, LLC, the CCPA will protect over $12 billion worth of personal information that is used for advertising in California each year. If finalized, businesses are estimated to spend between $467 million to $16,454 million in costs to comply with the draft regulation during the period 2020-2030. The CCPA grants new rights to consumers and imposes new obligations on businesses.

As highlighted in the CCPA Fact Sheet, published together with the proposed regulations, the CCPA and the European Union’s General Data Protection Regulation (“GDPR”) are separate legal frameworks with different scopes, definitions, and requirements. A business that is subject to GDPR and also processes personal information of California consumers will need to reconcile the differences between the two regimes. In addition, a business will need to examine what additional obligations apply under the CCPA that are outside of how personal information is collected, processed, sold or disclosed pursuant to the federal Gramm-Leach-Bliley Act, the California Financial Information Privacy Act, the Driver’s Privacy Protection Act of 1994, the Confidentiality of Medical Information Act, the Health Insurance Portability and Accountability Act of 1996 and the Federal Policy for the Protection of Human Subjects.

We submit the following comments on the proposed regulations.

All views expressed in these comments are our own as individual members of the PWG and do not represent the views of any entity whatsoever with which we have been, are now, or will be affiliated.

Overall Concerns:

The PWG notes that the proposed regulations will not be final before the January 1, 2020 effective date of the CCPA. Once the regulations are final, it will likely take most businesses several months to fully implement processes consistent with the final regulations. Accordingly, we urge the Office of the Attorney General to take into consideration the practical impact these regulations will have on businesses as well as the desire to protect consumer rights.

Our comments below are organized by section. We underlined for ease of reading new or amended language and we struck out language we propose to have deleted (i.e., underline or strike out).

Article 2. Notices to Consumers

§ 999.305. Notice at Collection of Personal Information

Section 999.305(a)(2)(d) provides that a notice at collection of personal information shall: “Be accessible to consumers with disabilities. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format.” This same language exists in § 999.306(a)(2)(d) (Notice of Right to Opt-Out of Sale of Personal Information), § 999.307(a)(2)(d) (Notice of Financial Incentive), and § 999.308(a)(2)(d) (Privacy Policy).

The PWG is concerned that “accessible” in the first sentence is unclear, ambiguous, and undefined. This could result in regulatory enforcement issues as well as prolonged litigation regarding interpretation and applicability, similar to other litigation we have already seen concerning website accessibility. In order to address this concern, the PWG suggests that the phrase “accessible to consumers with disabilities” be tied to the requirements of other specific provisions of law and recommends revising

§ 999.305(a)(2)(d) to read as follows:

§ 999.305(a)(2)(d)

Be accessible to consumers with disabilities to the extent required by the Americans with Disabilities Act, the Unruh Civil Rights Act, the California Disabled Persons Act, or any applicable regulations. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format.

We recommend that this same amendment be made to § 999.306(a)(2)(d)

§ 999.307(a)(2)(d), and § 999.308(a)(2)(d).

Section § 999.305(a)(3) appears to create an opt-in and consent requirement. The PWG is concerned that a new opt-in requirement not already part of CCPA will potentially lead to “click fatigue” in which consumers ignore notices because of their ubiquity. We think a better approach may be to limit the use of personal information to the purposes that were included in the notice at the time of collection or uses that are within the reasonable expectation of the consumer. We understand that the existing text of the CCPA already allows for exceptions that permit use of personal information for other purposes, as enumerated in Civil Code § 1798.145(a), including: (1) to comply with federal, state or local laws; (2) to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities; (3) to cooperate with law enforcement agencies concerning conduct or activity that the business, service provider,

or third party reasonably and in good faith believes may violate federal, state or local laws;

  1. to exercise or defend legal claims; and (5) to collect, use, retain, sell, or disclose consumer information that is deidentified or in the aggregate consumer information. As such, uses required by law or in furtherance of legal processes, such as serving subpoenas, providing required warranty or recall notices, providing notice of pending class actions, etc. would be permitted even if the notice at collection did not adequately cover these use cases. We recommend revising § 999.305(a)(3) to read as follows:

§ 999.305(a)(3)

A business shall not use a consumer’s personal information for any purpose other than those disclosed in the notice at collection, required by law, or reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business, or within a lawful manner that is compatible with the context in which the consumer provided the information. If the business intends to use a consumer’s personal information for a purpose that was not previously disclosed to the consumer in the notice at collection, the business shall use and obtain explicit consent from the consumer to use it for this new purpose.

Section § 999.305(b)(4) appears to require a link to a privacy policy in the notice at collection, implying the privacy policy must be a set of text that is separate from the notice at collection. The PWG suggests that if a privacy policy is provided at or before the time of collection, then a separate notice would not be required. We recommend revising § 999.305(b) to read as follows:

§ 999.305(b)

A business may inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used by providing a link to the privacy policy at or before the point of collection, or in the case of offline notices, the web address of the business’s privacy policy, by URL, QR code, or similar means. If the privacy policy or a link to the privacy policy cannot be provided at or before the time of collection, a business shall provide a separate notice at collection which includes:

    1. A list of the categories of personal information about consumers to be collected. Each category of personal information shall be written in a manner that provides consumers a meaningful understanding of the information being collected.
    2. For each category of personal information, the business or commercial purpose(s) for which it will be used.
    3. If the business sells personal information, the link titled “Do Not Sell My Personal Information” or “Do Not Sell My Info” required by section 999.315(a), or in the case of offline notices, the web address for the webpage to which it links.
    4. A link to the business’s privacy policy, or in the case of offline notices, the web address of the business’s privacy policy.

Similar to the change noted above, we recommend revising § 999.305(a)(2)(e) as follows, to allow for other means to link to privacy policies than web addresses, such as QR codes or shortened URLs such as bit.ly:

§ 999.305(a)(2)(e)

Be visible or accessible where consumers will see it in reasonable proximity to where any personal information is collected. At a minimum, the notice may consist of a link to the portion of the privacy policy that describes the categories of information collected and the purposes of collection, though a business may also choose to provide a separate notice, so long as the notice complies with this section. For example, when a business collects consumers’ personal information online, it may conspicuously post a link to the notice on the business’s website homepage or the mobile application’s download page, or on all webpages where personal information is collected. When a business collects consumers’ personal information offline, it may, for example, include the notice on printed forms that collect personal information, provide the consumer with a paper version of the notice, or post signage directing consumers to the web address where the notice can be found, by URL, QR code, or similar means.

§ 999.306. Notice of Right to Opt-Out of Sale of Personal Information

Similar to our comment for § 999.305, we recommend allowing businesses to provide the notice of right to opt-out as part of their privacy policy. We recommend revising § 999.306(b) to read as follows:

§ 999.306(b)(1)

A business may inform consumers as to the right to opt-out of sale of personal information by providing a link to the privacy policy, or in the case of offline notices, the web address of the business’s privacy policy, by URL, QR code, or similar means. If the privacy policy or a link to the privacy policy cannot be provided, a business shall provide a separate notice of right to opt-out. A business shall post the notice of right to opt-out on the Internet webpage to which the consumer is directed after clicking on the “Do Not Sell My Personal Information” or “Do Not Sell

My Info” link on the website homepage or the download or landing page of a mobile application. The Notice shall include the information specified in subsection (c) or link to the section of the business’s privacy policy that contains the same information. For example, one of the acceptable methods to provide the notice of right to opt-out would be for the business to provide the “Do Not Sell My Personal Information” or “Do Not Sell My Info” link on the website homepage or the download, settings or landing page of a mobile application and direct the consumer to the section of the business’s privacy policy that contains the information in subsection (c). Using pop-up or pop-over windows or check boxes may also be acceptable and appropriate means for informing consumers as to the right to opt- out.

We also recommend removing § 999.306(c)(5) so it is clear to the businesses that if a link to the privacy policy was provided, a separate notice of right to opt-out is not necessary.

We encourage the Office of the Attorney General to consider other permissible means of presenting the opt-out notice in § 999.306(b)(2), particularly for offline notices, such as providing the web address to the privacy policy or using QR codes which link to the privacy policy.

Article 3. Business Practices for Handling Consumer Requests

§ 999.312. Methods for Submitting Requests to Know and Requests to Delete

The proposed regulations in § 999.312(a) set forth the requirements for businesses to provide two or more designated methods through which consumers may submit requests to know. We ask the Office of the Attorney General to consider the legislative changes under AB 1564 (Stats. 2019, ch. 759), which clarify this toll-free number requirement and would require a business which “operates exclusively online and has a direct relationship with a consumer” to only provide an email address for submitting access requests.

We recommend revising § 999.312(a) to read as follows, adding this clarification to make the draft regulations consistent with the CCPA:

§ 999.312(a)

A business shall provide two or more designated methods for submitting requests to know including, at a minimum, a toll-free telephone number, and, if the business operates a website, an interactive webform accessible through the business’s website or mobile application. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115. Other acceptable methods for submitting these requests include, but are not limited to, a designated email address, a form submitted in person, and a form submitted through the mail.

We also recommend revising the proposed example (1) in § 999.312(c)(1) to clarify that if a business is primarily an online retailer but also has certain products or services that are provided to consumers at brick-and-mortar retail stores, the consumer may submit requests through the email address that is provided on the business’s retail website.

In Example 2, the PWG proposes revising the requirement so that the businesses can consider the methods by which they interact with consumers but the number of designated methods the retail businesses must provide is no more than the two that are required for other industries to avoid any confusion on the minimum requirement.

As such, our recommended revision to § 999.312(c) reads as follows:

§ 999.312(c)

A business shall consider the methods by which it interacts with consumers when determining which methods to provide for submitting requests to know and requests to delete. At least one method offered shall reflect the manner in which the business primarily interacts with the consumer, even if it requires a business to offer three methods for submitting requests to know. Illustrative examples follow:

      1. Example 1: If the business is primarily an online retailer, businesses can provide an email address on their retail website through which consumers can submit requests to know or requests to delete. at least one method by which the consumer may submit requests should be through the business’s retail website.
      2. Example 2: If the business operates a website but primarily interacts with customers in person at a retail location, the business may shall offer three methods to submit requests to know consumers the following designated methods for submitting requests to know or requests to delete: a toll-free telephone number, an interactive webform accessible through the

business’s website, and or a form that can be submitted in person at the retail location.

We understand that the intent of § 999.312(d) may be to allow for instances where a consumer may have submitted the deletion request by mistake, especially in an electronic setting where accidents may occur at the click of a button. However, we do not believe this is a significant issue as deletion requests under the CCPA already require a process for verifying the identity of the consumer. As such, we recommend revising § 999.312(d) to indicate that the businesses can apply discretion in asking the consumers if they indeed meant to submit such deletion request but it is not a requirement. Our suggested language for § 999.312(d) reads as follows:

§ 999.312(d)

A business may shall use a two-step for online requests to delete where the consumer must first, clearly submit the request to delete and then second, separately confirm that they want their personal information deleted.

The PWG suggests removing proposed §999.312(f) because it is overly burdensome and unworkable as drafted. If a business has 10,000 employees, we cannot expect all 10,000 employees to be trained to handle privacy-related inquiries. Especially given that the draft regulations require a response from the business within certain number of days after receiving such requests, we ask that the regulations do not add this new requirement and keep the requirement intact as it is written in the CCPA, which is for the businesses to respond to requests that are submitted through the designated methods. In the alternative, we would propose at a minimum that the requirement is amended to read as follows:

§ 999.312(f)

If a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the verification process, the business shall, to the extent feasible, either:

  1. Treat the request as if it had been submitted in accordance with the business’s designated manner, or
  2. Provide the consumer with specific directions on how to submit the request or remedy any deficiencies with the request, if applicable.

§ 999.313. Responding to Requests to Know and Requests to Delete

Section 999.313(c)(7) allows a business that maintains a password-protected account with the consumer to comply with a request to know by utilizing a secure self-service portal for consumers to access, view, and receive a portable copy of their personal

information. The PWG proposes the below changes to make clear that the business which uses such a portal may direct the consumer to the portal for submission and processing of a consumer request.

The PWG suggests revising § 999.313(c)(7) to read as follows:

§ 999.313(c)(7)

If a business maintains a password-protected account with the consumer, it may comply with a request to know by using directing the consumer to a secure self- service portal for consumers to access, view, and receive a portable copy of their personal information if the portal fully discloses the personal information that the consumer is entitled to under the CCPA and these regulations, uses reasonable data security controls, and complies with the verification requirements set forth in Article 4.

Section 999.313(d)(1) requires businesses to treat a failed deletion request as an opt-out request. The CCPA treats the right to opt-out and the right to delete as two separate rights. We do not recommend conflating the two and instead recommend clarifying that if the business is unable to verify the identity of the requestor for the deletion request, the requestor must be informed how she may rectify the issue and allow an opportunity to complete verification. The PWG recommends revising § 999.313(d)(1) to read as follows:

§ 999.313(d)(1)

For requests to delete, if a business cannot verify the identity of the requestor pursuant to the regulations set forth in Article 4, the business may deny the request to delete. The business shall inform the requestor that their identity cannot be verified, and shall instead treat the request as a request to opt-out of sale the information needed for verification, and allow the requestor to provide additional information to complete verification.

We understand the intent behind the proposed regulations in § 999.313(d)(3) may be to provide the businesses the flexibility to not have to search through and delete personal information from archived or backup systems if the information is not in use currently. We recommend revising the language in § 999.313(d)(3) to clarify that the requests to delete do not apply to information on archived or backup systems but if the information were accessed or used by the business, the deletion request would apply to that information. Our recommended version reads as follows:

§ 999.313(d)(3)

If a business stores any personal information on archived or backup systems, it may delay compliance with the consumer’s request to delete, with respect to data stored on the archived or backup system, until the archived or backup system is

next accessed or used. The consumers’ request to delete shall not apply to any personal information on archived or backup systems, as long as that information is not accessed or used by the business.

§ 999.315. Requests to Opt-Out

The CCPA already contains a provision which restricts the resale of personal information (see Civil Code § 1798.115(d)). We suggest removing § 999.315(f), as any third parties to whom the personal information is sold would already be restricted from reselling the personal information unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt-out. The proposed requirement to look back 90 days in § 999.315(f) is unnecessary and unduly burdensome.

§ 999.317. Training: Record-Keeping

In § 999.317(b), there is no clear indication of when the 24 month clock starts (i.e., from the date the business receives the request, responds to the request, etc.). The PWG recommends the Attorney General clarify when the 24 months record-keeping requirement begins. Recommended version of § 999.317(b) reads as follows:

§ 999.317(b)

A business shall maintain records of consumer requests made pursuant to the CCPA and how the business responded to said requests for at least 24 months from the date the consumer submitted any such request.

The PWG proposes a minor change to § 999.317(f) in order to provide clarity as to what record-keeping purpose it pertains. We recommend revising § 999.317(f) to read as follows:

§ 999.317(f)

Aside from this the record-keeping purpose referred to in subsection (e), a business is not required to retain personal information solely for the purpose of fulfilling a consumer request made under the CCPA.

Article 4. Verification of Requests

§ 999.325. Verification for Non-Accountholders

The PWG recommends adding language to § 999.325(c) to allow for electronic signatures, as follows:

§ 999.325(c)

A business’s compliance with a request to know specific pieces of personal information requires that the business verify the identity of the consumer making the request to a reasonably high degree of certainty, which is a higher bar for verification. A reasonably high degree of certainty may include matching at least three pieces of personal information provided by the consumer with personal information maintained by the business that it has determined to be reliable for the purpose of verifying the consumer together with a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request. A signed declaration may be physically signed or electronically signed. Businesses shall maintain all signed declarations as part of their record-keeping obligations.

Article 5. Special Rules Regarding Minors

§ 999.330. Minors Under 13 Years of Age

The PWG recommends adding language to § 999.330.(a)(2)(a) to allow for additional electronic methods for businesses to verify user identities. Recommended changes to

§ 999.330(a)(2)(a) reads as follows:

§ 999.330(a)(2)(a)

Providing a consent form to be signed physically or electronically by the parent or guardian under penalty of perjury and returned to the business by postal mail, electronic mail, electronic form, facsimile, or electronic scan;

We thank you for your consideration of these comments.

Members of the Privacy Working Group that prepared these comments are identified below. Affiliations are provided for identification purposes only.

Stanton Burke, Member of the California Lawyers Association

Christopher James Donewald, Member of the California Lawyers Association Aigerim Dyussenova, Member of the California Young Lawyers Association

Jennifer S. Elkayam, Member of the Antitrust, Unfair Competition, and Privacy Law Section of the California Lawyers Association

Jared Gordon, Past co-chair of the Internet and Privacy Law Committee of the Business Law Section of the California Lawyers Association

Christian Hammerl, Past co-chair of the Internet and Privacy Law Committee of the Business Law Section of the California Lawyers Association

Thomas A. Hassing, Chair of the Internet and Privacy Law Committee of the Business Law Section of the California Lawyers Association

Irene Jan, Member of the Intellectual Property Law Section of the California Lawyers Association

Minji Kim, Member of the Antitrust, UCL and Privacy Section of the California Lawyers Association

Joshua de Larios-Heiman, Executive Committee Member of the Antitrust, UCL and Privacy Section of the California Lawyers Association

Marina A. Lewis, Member of the California Lawyers Association Gayatri Raghunandan, Member of the California Lawyers Association

Mary Stone Ross, Executive Committee Member of the Antitrust, UCL and Privacy Section of the California Lawyers Association

Perry L. Segal, Board Representative, Law Practice Management and Technology Section of the California Lawyers Association

Jeewon Kim Serrato, Executive Committee Member of the Antitrust, UCL and Privacy Section of California Lawyers Association

Kieran de Terra, Executive Committee Member of the Intellectual Property Law Section of the California Lawyers Association

Emily S. Yu, Secretary of the Intellectual Property Law Section of the California Lawyers Association and Chair of the Technology, Internet and Privacy Interest Group

My Original, Unedited Public Comments to atils

Hi All:

I haven’t used this blawg much as I prefer Twitter these days (shorter & easier). However, as many of you know, I submitted a four-page public comment document through the California Lawyers Association, which is my proper channel to do so. As I’d stated at the time, the Government Affairs Committee collected and compiled comments from all of our sections, as well as individual comments from our members, to create a master document.

I think they did a terrific job. However, it did end up to be a ten-page document – and they weren’t able to incorporate all of my comments – but they had no problem with me both submitting my entire document to ATILS directly, and posting them publicly. Now, even at four pages, there was much more that I wanted to say, but preparing a thorough documents takes time, so I chose a reasonable ending point.

It’s important to understand that, while I support the goals of ATILS in principle, I have concerns; therefore I decided to write my comments as a thought piece in order to encourage the Task Force to think more broadly about the implications of their policies. Below are my comments, exactly as originally written (typos and all) on August 12, 2019:

ATILS COMMENTS – AUGUST 12, 2019

Perry L. Segal

CLA Board Representative, Law Practice Management and Technology Section

Attorney-at-Law, Charon Law

Technology and Management Consultant, Charon Solutions, Inc.

Dear ATILS:

I feel that I have a unique perspective as someone who spent twenty years in technology and technology management, then entered a second career as a technology attorney approximately twelve years ago (passing the July 2007 California Bar exam).  I also have two business entities:  A technology and management consultancy C-Corporation that I started in 1999 as well as a Sole Proprietorship Law practice that I started in 2008.  Further, as a Council Officer under the previous iteration of CLA, I was involved in the prior examination of these issues, which at the time was referred to as the, “Limited License Working Group.”

At the outset, let me say that the formal comment form that provides three position choices:  Support, Oppose or State No Preference, does the entire process a disservice.  I sense that like myself, others support some of the concepts, oppose some and are neutral on others.  What is a person like me supposed to select that won’t present a skewed picture of my views?

THE DIFFERENCE BETWEEN A LAWYER AND A NONLAWYER

PERCEPTION VS. REALITY

Many nonlawyers believe that they can be lawyers; some will be right, some will be wrong, but the biases and concepts that nonlawyers bring to the real-world practice of law are critical.  First, they’ve been exposed to what they think law practice looks like via television programs, radio, news and the internet.  Most of these programs have an interest in making the practice of law appear exciting and dramatic.  As most attorneys know, this is normally not the case.  There’s no exposure to the behind-the-scenes machinations that make up most lawyers’ days, and many of us have heard the phrase, “I could do that!” based on a completely false idea of what it means to be a lawyer.

Let me use myself as an example.  In the corporate world, I interfaced with legal departments all the time.  In one particular example, my technology group assisted the attorneys at Tri-Star Pictures to fight off a gargantuan eDiscovery demand – long before eDiscovery as a word existed.  I’d represented myself in small claims court – and won – and, having always regretted not going to law school, I thought, “I can do this!”  Well, having passed the California Bar exam, apparently, I can, but a lot transpired along the way.  For one thing, I quickly learned the difference between the layman’s concept of law vs. the reality.  I was lucky in one respect; my upbringing and job experience already prepared me to see all sides of an issue.  However, I saw most students struggle mightily with this more than almost anything else.  They’d always had opinions; and now they were being told to throw them away and see all facets of the problem.  For me, that came naturally – for most nonlawyers, it requires years of practice.  My support for this?  The current pass rates on the California Bar Exam.  Students are struggling.

If the Bar seeks to regulate nonlawyers, this and other issues must be addressed.  Without law school – and training during – and after – law school, how will one accomplish the goal of producing nonlawyers who can, “Think like a lawyer?” in a highly-compressed period of time?

FINANCIAL ASPECTS

As I’ve said to colleagues before, the issue of allowing nonlawyers to provide legal advice might make sense as a concept, but I keep seeing it couched as lawyers practicing protectionism, or lawyers refusing to accept change, or lawyers belly-aching that they had to pay for years of very-expensive law school and toil away as a low-paid associate – and nonlawyers will bypass this requirement.  Lawyers are mocked and told to “get with the program” and condescendingly told to accept the coming future of our technological overlords.  Well, I’ve been immersed in technology since I was a teenager and In my view, this is simplistic, and actually diminishes the inherent risks involved, one of which is the danger of creating the Uber of legal advice.

What seems to be lost in the discussion is the model under which nonlawyer practice would operate.  There should be a focus on the costs of lawyers vs. nonlawyers that doesn’t focus on the above inequities, but because of what effect it will have on the relationship between lawyers and nonlawyers.  For example, Bob is a lawyer.  Tim is not.  Bob has a ton of overhead operating his practice.  Tim does not.  Therefore, Tim rightly surmises that he can charge much less for his service, yet earn the same profit margin as Bob, so he does it.  Bob, experiencing the predictable drop of business due to this, is forced to lower his prices as well.  Bob’s activity increases, but Tim’s falls somewhat, so Tim elects to make a little less profit, and lowers his fees again.  Unchecked – and absent the understanding that this is a likely result – could result in a race to the bottom; and both sides lose.

If this is to be attempted, there must be a framework to address problems like these.

UNAUTHORIZED PRACTICE OF LAW (UPL)

I teach CLEs to educate attorneys, young and old, about the ethical challenges of the combination of technology and law.  A primary part of my practice is assisting lawyers to market ethically via social media.  Here’s what I’ve learned in one sentence:  Older attorneys are too cautious with technology, but younger attorneys are not cautious enough!

Like it or not, we already possess demographics to illustrate the divergence between tech use by older attorneys vs. younger ones, but there’s another divergence:  The difference between practicing the required amount of caution vs. those who throw caution to the wind.  Technology is only as talented as those who design it – and the public is very excited about using these new technologies – but one must keep in mind: self-driving cars keep killing people, listening devices are listening a little too much, and social media sites are aggregating and selling your data.  For the nonlawyer, the goal is profit – and there’s nothing wrong with that.  However…

Like it or not, attorneys must forgo profit in exchange for ethics.  I’m contacted constantly by attorneys who wish to advertise via social media, and must advise them that ethically, they simply cannot do it “that way”.  Both new and career attorneys argue with me until they’re blue in the face to try to persuade me to give them the fork in the road that will allow them around the ethical rules; but there is no fork available.  If even the attorneys can’t see it, the regulators had better be wary of what the nonlawyers see.

It’s not the software; it’s the mindset of the individual(s) using it.  Mindsets are very difficult to change, especially for people who have no idea how technology actually works.  The good news is it can be done.

NONLAWYER FINANCIAL INTEREST IN A LAW PRACTICE

I think this is the most intriguing to me of these proposals, especially as an individual who is forced to operate two business entities due to the restrictions on lawyers.  This means, separate bank accounts.  Separate credit cards, separate financial statements, separate tax returns, separate business licenses, separate franchise taxes (in CA); even separate phone numbers, email addresses, business cards and stationery.  In short, costs that could be avoided.  All things being equal, ethical people would have no problem accomplishing this goal.  Unfortunately, not all people have ethical goals.  There are conflict-of-interest issues to examine – and I’m obviously not the first to mention them.

First, let’s examine a real-world example of what I consider an ominous illustration of the potential dangers conflict of interest could cause.  It occurred in Florida, but has a California connection:  Terry Gene BOLLEA, professionally known as Hulk Hogan, Plaintiff, v. GAWKER MEDIA, LLC, et al., DefendantUnited States District Court, M.D. Florida, Tampa Division.  December 21, 2012. [https://www.leagle.com/decision/inadvfdco131011000161]

In short, Hulk Hogan had a valid claim against Gawker.  The case was filed in USDC in Florida.  However, what was not revealed until much later was that Hogan had a secret benefactor who had his own serious personal beef with Gawker – and bankrolled Hogan to the tune of $10 million dollars:  Silicon Valley billionaire Peter Thiel [https://www.nytimes.com/2016/05/26/business/dealbook/peter-thiel-tech-billionaire-reveals-secret-war-with-gawker.html]:

“What the jury — and the public — did not know was that Mr. Bollea [Hogan] had a secret benefactor paying about $10 million for the lawsuit: Peter Thiel, a co-founder of PayPal and one of the earliest investors in Facebook.”

It’s important to note that Mr. Thiel is a lawyer; however, his status as such has nothing to do with what occurred here.  He was a disinterested party in this case – or so it appeared.  From the article:

“He said that he hired a legal team several years ago to look for cases that he could help financially support. ‘Without going into all the details, we would get in touch with the plaintiffs who otherwise would have accepted a pittance for a settlement, and they were obviously quite happy to have this sort of support,’ he said. ‘In a way very similar to how a plaintiff’s lawyer on contingency would do it.’  But there was another element involved:

“A 2007 article published by Gawker’s Valleywag blog was headlined, “Peter Thiel is totally gay, people.” That and a series of articles about his friends and others that he said “ruined people’s lives for no reason” drove Mr. Thiel to mount a clandestine war against Gawker. He funded a team of lawyers to find and help “victims” of the company’s coverage mount cases against Gawker.”

The implications are obvious, so I won’t repeat them.  Some would argue – and in my opinion, fairly – that this is the same thing that law firms do now (take cases on contingency); but is it?  When a law firm considers contingency, one obvious goal is winning, but the firm practices various tests to attempt to evaluate the risk/reward vs. the potential strength of the case.  In any case where an “outsider” becomes an “insider”, there must be serious evaluation as to what potential outcomes might be.  If there isn’t some sort of ethical wall of separation between the investor side of the business and the lawyers best qualified to evaluate the health of a choice, the investor could potentially demand that the firm sue a competitor of theirs for an advantage, or pursue a case that is potentially unwinnable – but can be brought with the bare level of probable cause – but is initiated with a sinister goal in mind and not the achievement of justice for the client (or is the investor the client?).

Investment banking firms possess a similar ethical wall of separation.  Perhaps a model to examine?  [https://www.investopedia.com/articles/analyst/090501.asp]

LAWYERS SHARING FEES WITH NONLAWYERS

Briefly, I see this as a similar issue to outside investment, but in reverse.  I had a case several years ago where a firm wished to ethically advertise and accepted the assurance of a vendor that they would advertise according to attorney ethical rules.  In short, the vendor did not do so, and with the first advertisement, a partner in the firm was brought up on a state bar’s ethical violations.  I was hired to find the way out.  When I spoke to the vendor, they were incensed when I informed them of how they’d violated attorney ethics and put the attorney at risk.  “That’s stupid!”, they said.  My answer (which is the same today as it was then): “It may be stupid or not, but it’s the rule!”.  Others have already addressed that nonlawyers don’t have a license to lose, but I think it goes further than that:  Nonlawyers also don’t have years of experience, completed extensive coursework and had to pass more than one exam on the subject (law school itself, and potentially both the MPRE and also having it tested again on the Bar exam).

CONCLUSION

I hope my comments are taken as I meant them to be:  A plea to stop simplifying these extremely complex issues and a commitment that, if we as a profession decide to move forward with some – or all – of these recommendations, hopefully, my information may be used as a thought piece to seriously address these issues.  We must find a way to provide access to justice to those who desperately need it, and we need to find that fork in the road, even if there’s some pain along the way.  I, and a large group of people who believe the same as I do, successfully spun off the Sections into the CLA.  Was there pain?  Yes.  Yet here we are, in spite of it.

With my best regards, and best wishes for good luck, I thank you for considering my comments.  I’m at your service.

Perry L. Segal

LPMT 2019 LAW + TECHNOLOGY SUMMIT – JAN. 25-26

Mark your calendars!  The Law Practice Management and Technology Section of the California Lawyers Association, in partnership with the San Diego County Bar Association, presents the 2nd Annual Law + Technology Summit, in San Diego. #LawPlusTech

Lifetime Achievement Award

As many of you know, I Chaired the move of the former Sections of the State Bar of California to our new entity, the California Lawyers Association.

I was busy.

Speaking of busy, I’m proud to announce that the Law Practice Management and Technology Section presented me with the Lifetime Achievement Award.  This actually took place on September 14, 2018, but I’ve been bu…you get the idea.

What makes this award so sweet is that I have been with LPMT for nine years, and am just coming up on my eleventh anniversary of becoming an attorney.

I guess what they’re saying is, I’ve lived a lifetime during the past decade!

1st Annual California Lawyers Association Meeting – September 14-15, 2018 in San Diego!

OK – get out your playbooks:  Last year, The Sections were still part of the State Bar of California, but our annual meeting was separate from the Bar and was called the “1st Annual Calbar Section Convention“.  On January 1st, 2018, the Sections were spun off into our own entity, the California Lawyers Association (CLA) – and with a new entity comes a new event name:  The “California Lawyers Association Annual Meeting”.  Got all that?

So, I’m dropping by to tell you that I’ll be presenting a one-hour program in San Diego at 3:10 pm on Saturday, September 15th with my colleague from the California Young Lawyers Association, Michael Iseri:

Program 42:  Legal Cyber Security:  Best Standards and Practices for Law Firms

Keep an eye on the CLA’s page for the event for further details.

LPMT 2018 Law + Technology Summit – Jan. 26-27

Mark your calendars.  As one of the first out of the gate for the new California Lawyers Association, the Law Practice Management and Technology Section, in partnership with the San Diego County Bar Association, presents the inaugural 2018 Law + Technology Summit, in (where else?) San Diego.

Yours truly will be doing a program on Ethical Considerations for your Online Presence.  Click here for more details!

The State Bar of California Sections is Now the California Lawyers Association

Happy New Year!

So, why am I never writing blog posts anymore?  Because for the last two-plus years, I’ve been working to complete the transition of the The Sections from the State Bar of California into a private entity – the last four months as Chair.

As of January 1, 2018, the California Lawyers Association became our official home.  Visit us at our new site, cla.legal.

1st Annual Calbar Section Convention – August 18-19, 2017 in San Diego!

2017-08-18_section-convention

You may have noticed that I don’t post much anymore.  However, I’d like to mention that yours truly will be presenting a program at the convention:

Date: Friday, August 18, 2017
Program Time: 10:30 AM – 11:30 AM
Program Number: 9
Program Title: Using Technology in Trial to be Persuasive and Stay Organized
Speakers:
Jeffrey Bennion and Perry Segal

Now, in the spirit of continuing my new tradition, I’m posting the information and links verbatim.

Section Convention

The Sections of The State Bar of California are pleased to announce plans for the inaugural Section Convention on August 18 and 19, 2017 in San Diego.

August 18-19, 2017
Sheraton San Diego Hotel & Spa
1380 Harbor Island Drive
San Diego, CA 92101

Earn 12 Hours of Participatory MCLE Credit, Including Legal Ethics and Competence Issues

Thirty-six  education programs, all approved for MCLE credit.

Hundreds of California lawyers, judicial officers and legal staff in attendance.

Much more is planned, so save the date.  Details will be published at Section Convention soon!

EDISCOVERY CALIFORNIA: FORMAL OPINION NO. 2016-196 – ATTORNEY BLOGGING

Disclaimer:  This is a State Bar of California Opinion, and I’m Vice-Chair of the Council of California State Bar Sections (CSBS).  I want to remind you, “This blog site is published by and reflects the personal views of Perry L. Segal, in his individual capacity.  Any views expressed herein have not been adopted by the State Bar of California’s Board of Trustees or overall membership, nor are they to be construed as representing the position of the State Bar of California.”

To put it simply, the premise of CAL 2016-196 is to address when:  1) A blog post becomes a “communication”, as defined under the RPC and the State Bar Act, and 2) If it is deemed a communication, is it “attorney advertising”?

First of all, what constitutes a blog (or, as I prefer to call legal blogs, a “blawg”)?  Hmmm.  Well, if you call it a blawg, that’s probably a big hint that it’ll be legal in nature, but that’s not really what I’m getting at here.  Are your scribbles on Facebook, Twitter and Instagram “blogging”, for the purposes of this opinion?

You bet (if those scribbles are legal in nature and/or purport to advertise your services).  You may not be aware of it, but products like Twitter are referred to as “micro-blogs”.

I think the continuing problem with a lot of these opinions is that they cause people to lose their minds worrying about them as if they’re something new.  The reality is, technically, a blog post is no different than if it were an article in a magazine that had a little blurb at the end that includes your contact information.  You’ll be subject to regulation for attorney advertising (California’s Rule of Professional Conduct, rule 1-400 – Advertising & Solicitation).

The real differences?

  • Someone has to subscribe to the magazine, receive it for free or pick it up in the dentist’s office office or a friend’s home.  However, if your blog is public, you need to understand, that means public; available to anyone, anywhere in the world at any time who has access to the internet.
  • The jurisdiction in which someone reads it may not authorize attorney blogging.

I bet many of you see where I’m going with the second point.  Could this trigger an accusation of improper advertising?  What about an in-depth article including opinion on a particular law?  Could that be unauthorized practice of law?

Yes and yes.  So what do you do?  For starters, click on the link above and read the opinion.  It’s only eight pages, and you’ll quickly see that a lot of it triggers opinions you’ve seen before, such as CAL 2012-186.  Two, disclaim, Disclaim, DISCLAIM.  Many a problem is eliminated if you simply inform your readers of your audience.

Of course, you can’t do that on Twitter.  So you might link to your disclaimer, or state briefly, “All opinions are my own.”

Oh, and there’s this last bugaboo:  You must be able to reproduce each and every post you’ve made for the past two years (while you’re gasping, keep in mind, it’s three years in New York).

Re-Elected to a Second, Three-Year Term on the Council of State Bar Sections

csbs-tombstoneOn the heels of being awarded a tombstone for completing my three-year term on the Council, I was re-elected to a second term.

This is unprecedented (probably because prior officers had the good sense not to run again!).  My co-officer, Mark Ressa, was also re-elected.  The unanimous view from our colleagues: Gluttons for punishment.

With no fee bill or resolution to the issue of de-unification/separation, these are extremely challenging times for the Sections.  It’s anybody’s guess how we’ll be structured a year from now.

Tombstone, indeed.

An IT Executive Turned Privacy, Cyber Security & Litigation Attorney and Consultant Shares his Personal Insights.