Category Archives: Strategy

CALIFORNIA LAWYERS ASSOCIATION PWG: Proposed California Consumer Privacy Act Regulations – COMMENTS

Hello Again, All:

Last week, on Twitter, I promised to try to post the California Lawyers Association Privacy Working Group’s comments on the California Consumer Privacy Act.  I made it.  Before you skip directly to the comments, I wanted to briefly discuss my specific role and also make a suggestion (it’s my blawg, so I get to do that!)

My colleagues are attorneys who immersed themselves in technology and the law.  In my case the opposite is true.  I’m a technology professional who passed the California Bar when I was 44 years old (2007, for the curious).  As such, I became the ‘roving technology consultant’ on the various aspects of this law.  In short, I worked with several of our writing subgroups to identify where the concepts in the law don’t mesh with how the technology actually works.

Aside from some minor formatting differences between WordPress and the original – plus some bolds and one URL added by me – these are verbatim comments.

The suggestion?  While you may discern most of the original issues via the comments alone, it would be best to review the proposed regulations that these comments address.

Estimates are that implementation of CCPA may cost $55 billion – and it does not exclusively apply to California companies – so, we understand and appreciate your interest in being well-informed.

Best wishes for the holiday season and the adventure that awaits us in 2020!

Perry

**************************************************************************

December 6, 2019

Privacy Regulations Coordinator

California Office of the Attorney General

300 South Spring Street, First Floor

Los Angeles, CA 90013

Email: PrivacyRegulations@doj.ca.gov

Re: Proposed California Consumer Privacy Act Regulations

Dear Attorney General Becerra:

The California Lawyers Association (“CLA”) Privacy Working Group (“PWG”) respectfully submits these comments on the proposed California Consumer Privacy Act (“CCPA”) regulations. The PWG is a multidisciplinary group with members drawn from various sections of the California Lawyers Association, including: Antitrust, UCL and Privacy; Business Law; and Intellectual Property Law. Our members have broad-ranging expertise in areas that include consumer privacy, cybersecurity, and data protection, and extensive experience with related regulatory, transactional, and litigation matters.

The Attorney General released these proposed regulations for public comment on October 10, 2019. The regulations are intended to operationalize the CCPA and provide clarity and specificity to assist in the implementation of the law. The CCPA requires the Attorney General to adopt initial regulations on or before July 1, 2020.

The PWG applauds the Office of the Attorney General for engaging in a broad and inclusive rulemaking process, including public forums. This public comment period is important because the stakes are high. According to estimates in the Standardized Regulatory Impact Assessment for the CCPA regulations, published by the Berkeley Economic Advising and Research, LLC, the CCPA will protect over $12 billion worth of personal information that is used for advertising in California each year. If finalized, businesses are estimated to spend between $467 million to $16,454 million in costs to comply with the draft regulation during the period 2020-2030. The CCPA grants new rights to consumers and imposes new obligations on businesses.

As highlighted in the CCPA Fact Sheet, published together with the proposed regulations, the CCPA and the European Union’s General Data Protection Regulation (“GDPR”) are separate legal frameworks with different scopes, definitions, and requirements. A business that is subject to GDPR and also processes personal information of California consumers will need to reconcile the differences between the two regimes. In addition, a business will need to examine what additional obligations apply under the CCPA that are outside of how personal information is collected, processed, sold or disclosed pursuant to the federal Gramm-Leach-Bliley Act, the California Financial Information Privacy Act, the Driver’s Privacy Protection Act of 1994, the Confidentiality of Medical Information Act, the Health Insurance Portability and Accountability Act of 1996 and the Federal Policy for the Protection of Human Subjects.

We submit the following comments on the proposed regulations.

All views expressed in these comments are our own as individual members of the PWG and do not represent the views of any entity whatsoever with which we have been, are now, or will be affiliated.

Overall Concerns:

The PWG notes that the proposed regulations will not be final before the January 1, 2020 effective date of the CCPA. Once the regulations are final, it will likely take most businesses several months to fully implement processes consistent with the final regulations. Accordingly, we urge the Office of the Attorney General to take into consideration the practical impact these regulations will have on businesses as well as the desire to protect consumer rights.

Our comments below are organized by section. We underlined for ease of reading new or amended language and we struck out language we propose to have deleted (i.e., underline or strike out).

Article 2. Notices to Consumers

§ 999.305. Notice at Collection of Personal Information

Section 999.305(a)(2)(d) provides that a notice at collection of personal information shall: “Be accessible to consumers with disabilities. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format.” This same language exists in § 999.306(a)(2)(d) (Notice of Right to Opt-Out of Sale of Personal Information), § 999.307(a)(2)(d) (Notice of Financial Incentive), and § 999.308(a)(2)(d) (Privacy Policy).

The PWG is concerned that “accessible” in the first sentence is unclear, ambiguous, and undefined. This could result in regulatory enforcement issues as well as prolonged litigation regarding interpretation and applicability, similar to other litigation we have already seen concerning website accessibility. In order to address this concern, the PWG suggests that the phrase “accessible to consumers with disabilities” be tied to the requirements of other specific provisions of law and recommends revising

§ 999.305(a)(2)(d) to read as follows:

§ 999.305(a)(2)(d)

Be accessible to consumers with disabilities to the extent required by the Americans with Disabilities Act, the Unruh Civil Rights Act, the California Disabled Persons Act, or any applicable regulations. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format.

We recommend that this same amendment be made to § 999.306(a)(2)(d)

§ 999.307(a)(2)(d), and § 999.308(a)(2)(d).

Section § 999.305(a)(3) appears to create an opt-in and consent requirement. The PWG is concerned that a new opt-in requirement not already part of CCPA will potentially lead to “click fatigue” in which consumers ignore notices because of their ubiquity. We think a better approach may be to limit the use of personal information to the purposes that were included in the notice at the time of collection or uses that are within the reasonable expectation of the consumer. We understand that the existing text of the CCPA already allows for exceptions that permit use of personal information for other purposes, as enumerated in Civil Code § 1798.145(a), including: (1) to comply with federal, state or local laws; (2) to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities; (3) to cooperate with law enforcement agencies concerning conduct or activity that the business, service provider,

or third party reasonably and in good faith believes may violate federal, state or local laws;

  1. to exercise or defend legal claims; and (5) to collect, use, retain, sell, or disclose consumer information that is deidentified or in the aggregate consumer information. As such, uses required by law or in furtherance of legal processes, such as serving subpoenas, providing required warranty or recall notices, providing notice of pending class actions, etc. would be permitted even if the notice at collection did not adequately cover these use cases. We recommend revising § 999.305(a)(3) to read as follows:

§ 999.305(a)(3)

A business shall not use a consumer’s personal information for any purpose other than those disclosed in the notice at collection, required by law, or reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business, or within a lawful manner that is compatible with the context in which the consumer provided the information. If the business intends to use a consumer’s personal information for a purpose that was not previously disclosed to the consumer in the notice at collection, the business shall use and obtain explicit consent from the consumer to use it for this new purpose.

Section § 999.305(b)(4) appears to require a link to a privacy policy in the notice at collection, implying the privacy policy must be a set of text that is separate from the notice at collection. The PWG suggests that if a privacy policy is provided at or before the time of collection, then a separate notice would not be required. We recommend revising § 999.305(b) to read as follows:

§ 999.305(b)

A business may inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used by providing a link to the privacy policy at or before the point of collection, or in the case of offline notices, the web address of the business’s privacy policy, by URL, QR code, or similar means. If the privacy policy or a link to the privacy policy cannot be provided at or before the time of collection, a business shall provide a separate notice at collection which includes:

    1. A list of the categories of personal information about consumers to be collected. Each category of personal information shall be written in a manner that provides consumers a meaningful understanding of the information being collected.
    2. For each category of personal information, the business or commercial purpose(s) for which it will be used.
    3. If the business sells personal information, the link titled “Do Not Sell My Personal Information” or “Do Not Sell My Info” required by section 999.315(a), or in the case of offline notices, the web address for the webpage to which it links.
    4. A link to the business’s privacy policy, or in the case of offline notices, the web address of the business’s privacy policy.

Similar to the change noted above, we recommend revising § 999.305(a)(2)(e) as follows, to allow for other means to link to privacy policies than web addresses, such as QR codes or shortened URLs such as bit.ly:

§ 999.305(a)(2)(e)

Be visible or accessible where consumers will see it in reasonable proximity to where any personal information is collected. At a minimum, the notice may consist of a link to the portion of the privacy policy that describes the categories of information collected and the purposes of collection, though a business may also choose to provide a separate notice, so long as the notice complies with this section. For example, when a business collects consumers’ personal information online, it may conspicuously post a link to the notice on the business’s website homepage or the mobile application’s download page, or on all webpages where personal information is collected. When a business collects consumers’ personal information offline, it may, for example, include the notice on printed forms that collect personal information, provide the consumer with a paper version of the notice, or post signage directing consumers to the web address where the notice can be found, by URL, QR code, or similar means.

§ 999.306. Notice of Right to Opt-Out of Sale of Personal Information

Similar to our comment for § 999.305, we recommend allowing businesses to provide the notice of right to opt-out as part of their privacy policy. We recommend revising § 999.306(b) to read as follows:

§ 999.306(b)(1)

A business may inform consumers as to the right to opt-out of sale of personal information by providing a link to the privacy policy, or in the case of offline notices, the web address of the business’s privacy policy, by URL, QR code, or similar means. If the privacy policy or a link to the privacy policy cannot be provided, a business shall provide a separate notice of right to opt-out. A business shall post the notice of right to opt-out on the Internet webpage to which the consumer is directed after clicking on the “Do Not Sell My Personal Information” or “Do Not Sell

My Info” link on the website homepage or the download or landing page of a mobile application. The Notice shall include the information specified in subsection (c) or link to the section of the business’s privacy policy that contains the same information. For example, one of the acceptable methods to provide the notice of right to opt-out would be for the business to provide the “Do Not Sell My Personal Information” or “Do Not Sell My Info” link on the website homepage or the download, settings or landing page of a mobile application and direct the consumer to the section of the business’s privacy policy that contains the information in subsection (c). Using pop-up or pop-over windows or check boxes may also be acceptable and appropriate means for informing consumers as to the right to opt- out.

We also recommend removing § 999.306(c)(5) so it is clear to the businesses that if a link to the privacy policy was provided, a separate notice of right to opt-out is not necessary.

We encourage the Office of the Attorney General to consider other permissible means of presenting the opt-out notice in § 999.306(b)(2), particularly for offline notices, such as providing the web address to the privacy policy or using QR codes which link to the privacy policy.

Article 3. Business Practices for Handling Consumer Requests

§ 999.312. Methods for Submitting Requests to Know and Requests to Delete

The proposed regulations in § 999.312(a) set forth the requirements for businesses to provide two or more designated methods through which consumers may submit requests to know. We ask the Office of the Attorney General to consider the legislative changes under AB 1564 (Stats. 2019, ch. 759), which clarify this toll-free number requirement and would require a business which “operates exclusively online and has a direct relationship with a consumer” to only provide an email address for submitting access requests.

We recommend revising § 999.312(a) to read as follows, adding this clarification to make the draft regulations consistent with the CCPA:

§ 999.312(a)

A business shall provide two or more designated methods for submitting requests to know including, at a minimum, a toll-free telephone number, and, if the business operates a website, an interactive webform accessible through the business’s website or mobile application. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115. Other acceptable methods for submitting these requests include, but are not limited to, a designated email address, a form submitted in person, and a form submitted through the mail.

We also recommend revising the proposed example (1) in § 999.312(c)(1) to clarify that if a business is primarily an online retailer but also has certain products or services that are provided to consumers at brick-and-mortar retail stores, the consumer may submit requests through the email address that is provided on the business’s retail website.

In Example 2, the PWG proposes revising the requirement so that the businesses can consider the methods by which they interact with consumers but the number of designated methods the retail businesses must provide is no more than the two that are required for other industries to avoid any confusion on the minimum requirement.

As such, our recommended revision to § 999.312(c) reads as follows:

§ 999.312(c)

A business shall consider the methods by which it interacts with consumers when determining which methods to provide for submitting requests to know and requests to delete. At least one method offered shall reflect the manner in which the business primarily interacts with the consumer, even if it requires a business to offer three methods for submitting requests to know. Illustrative examples follow:

      1. Example 1: If the business is primarily an online retailer, businesses can provide an email address on their retail website through which consumers can submit requests to know or requests to delete. at least one method by which the consumer may submit requests should be through the business’s retail website.
      2. Example 2: If the business operates a website but primarily interacts with customers in person at a retail location, the business may shall offer three methods to submit requests to know consumers the following designated methods for submitting requests to know or requests to delete: a toll-free telephone number, an interactive webform accessible through the

business’s website, and or a form that can be submitted in person at the retail location.

We understand that the intent of § 999.312(d) may be to allow for instances where a consumer may have submitted the deletion request by mistake, especially in an electronic setting where accidents may occur at the click of a button. However, we do not believe this is a significant issue as deletion requests under the CCPA already require a process for verifying the identity of the consumer. As such, we recommend revising § 999.312(d) to indicate that the businesses can apply discretion in asking the consumers if they indeed meant to submit such deletion request but it is not a requirement. Our suggested language for § 999.312(d) reads as follows:

§ 999.312(d)

A business may shall use a two-step for online requests to delete where the consumer must first, clearly submit the request to delete and then second, separately confirm that they want their personal information deleted.

The PWG suggests removing proposed §999.312(f) because it is overly burdensome and unworkable as drafted. If a business has 10,000 employees, we cannot expect all 10,000 employees to be trained to handle privacy-related inquiries. Especially given that the draft regulations require a response from the business within certain number of days after receiving such requests, we ask that the regulations do not add this new requirement and keep the requirement intact as it is written in the CCPA, which is for the businesses to respond to requests that are submitted through the designated methods. In the alternative, we would propose at a minimum that the requirement is amended to read as follows:

§ 999.312(f)

If a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the verification process, the business shall, to the extent feasible, either:

  1. Treat the request as if it had been submitted in accordance with the business’s designated manner, or
  2. Provide the consumer with specific directions on how to submit the request or remedy any deficiencies with the request, if applicable.

§ 999.313. Responding to Requests to Know and Requests to Delete

Section 999.313(c)(7) allows a business that maintains a password-protected account with the consumer to comply with a request to know by utilizing a secure self-service portal for consumers to access, view, and receive a portable copy of their personal

information. The PWG proposes the below changes to make clear that the business which uses such a portal may direct the consumer to the portal for submission and processing of a consumer request.

The PWG suggests revising § 999.313(c)(7) to read as follows:

§ 999.313(c)(7)

If a business maintains a password-protected account with the consumer, it may comply with a request to know by using directing the consumer to a secure self- service portal for consumers to access, view, and receive a portable copy of their personal information if the portal fully discloses the personal information that the consumer is entitled to under the CCPA and these regulations, uses reasonable data security controls, and complies with the verification requirements set forth in Article 4.

Section 999.313(d)(1) requires businesses to treat a failed deletion request as an opt-out request. The CCPA treats the right to opt-out and the right to delete as two separate rights. We do not recommend conflating the two and instead recommend clarifying that if the business is unable to verify the identity of the requestor for the deletion request, the requestor must be informed how she may rectify the issue and allow an opportunity to complete verification. The PWG recommends revising § 999.313(d)(1) to read as follows:

§ 999.313(d)(1)

For requests to delete, if a business cannot verify the identity of the requestor pursuant to the regulations set forth in Article 4, the business may deny the request to delete. The business shall inform the requestor that their identity cannot be verified, and shall instead treat the request as a request to opt-out of sale the information needed for verification, and allow the requestor to provide additional information to complete verification.

We understand the intent behind the proposed regulations in § 999.313(d)(3) may be to provide the businesses the flexibility to not have to search through and delete personal information from archived or backup systems if the information is not in use currently. We recommend revising the language in § 999.313(d)(3) to clarify that the requests to delete do not apply to information on archived or backup systems but if the information were accessed or used by the business, the deletion request would apply to that information. Our recommended version reads as follows:

§ 999.313(d)(3)

If a business stores any personal information on archived or backup systems, it may delay compliance with the consumer’s request to delete, with respect to data stored on the archived or backup system, until the archived or backup system is

next accessed or used. The consumers’ request to delete shall not apply to any personal information on archived or backup systems, as long as that information is not accessed or used by the business.

§ 999.315. Requests to Opt-Out

The CCPA already contains a provision which restricts the resale of personal information (see Civil Code § 1798.115(d)). We suggest removing § 999.315(f), as any third parties to whom the personal information is sold would already be restricted from reselling the personal information unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt-out. The proposed requirement to look back 90 days in § 999.315(f) is unnecessary and unduly burdensome.

§ 999.317. Training: Record-Keeping

In § 999.317(b), there is no clear indication of when the 24 month clock starts (i.e., from the date the business receives the request, responds to the request, etc.). The PWG recommends the Attorney General clarify when the 24 months record-keeping requirement begins. Recommended version of § 999.317(b) reads as follows:

§ 999.317(b)

A business shall maintain records of consumer requests made pursuant to the CCPA and how the business responded to said requests for at least 24 months from the date the consumer submitted any such request.

The PWG proposes a minor change to § 999.317(f) in order to provide clarity as to what record-keeping purpose it pertains. We recommend revising § 999.317(f) to read as follows:

§ 999.317(f)

Aside from this the record-keeping purpose referred to in subsection (e), a business is not required to retain personal information solely for the purpose of fulfilling a consumer request made under the CCPA.

Article 4. Verification of Requests

§ 999.325. Verification for Non-Accountholders

The PWG recommends adding language to § 999.325(c) to allow for electronic signatures, as follows:

§ 999.325(c)

A business’s compliance with a request to know specific pieces of personal information requires that the business verify the identity of the consumer making the request to a reasonably high degree of certainty, which is a higher bar for verification. A reasonably high degree of certainty may include matching at least three pieces of personal information provided by the consumer with personal information maintained by the business that it has determined to be reliable for the purpose of verifying the consumer together with a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request. A signed declaration may be physically signed or electronically signed. Businesses shall maintain all signed declarations as part of their record-keeping obligations.

Article 5. Special Rules Regarding Minors

§ 999.330. Minors Under 13 Years of Age

The PWG recommends adding language to § 999.330.(a)(2)(a) to allow for additional electronic methods for businesses to verify user identities. Recommended changes to

§ 999.330(a)(2)(a) reads as follows:

§ 999.330(a)(2)(a)

Providing a consent form to be signed physically or electronically by the parent or guardian under penalty of perjury and returned to the business by postal mail, electronic mail, electronic form, facsimile, or electronic scan;

We thank you for your consideration of these comments.

Members of the Privacy Working Group that prepared these comments are identified below. Affiliations are provided for identification purposes only.

Stanton Burke, Member of the California Lawyers Association

Christopher James Donewald, Member of the California Lawyers Association Aigerim Dyussenova, Member of the California Young Lawyers Association

Jennifer S. Elkayam, Member of the Antitrust, Unfair Competition, and Privacy Law Section of the California Lawyers Association

Jared Gordon, Past co-chair of the Internet and Privacy Law Committee of the Business Law Section of the California Lawyers Association

Christian Hammerl, Past co-chair of the Internet and Privacy Law Committee of the Business Law Section of the California Lawyers Association

Thomas A. Hassing, Chair of the Internet and Privacy Law Committee of the Business Law Section of the California Lawyers Association

Irene Jan, Member of the Intellectual Property Law Section of the California Lawyers Association

Minji Kim, Member of the Antitrust, UCL and Privacy Section of the California Lawyers Association

Joshua de Larios-Heiman, Executive Committee Member of the Antitrust, UCL and Privacy Section of the California Lawyers Association

Marina A. Lewis, Member of the California Lawyers Association Gayatri Raghunandan, Member of the California Lawyers Association

Mary Stone Ross, Executive Committee Member of the Antitrust, UCL and Privacy Section of the California Lawyers Association

Perry L. Segal, Board Representative, Law Practice Management and Technology Section of the California Lawyers Association

Jeewon Kim Serrato, Executive Committee Member of the Antitrust, UCL and Privacy Section of California Lawyers Association

Kieran de Terra, Executive Committee Member of the Intellectual Property Law Section of the California Lawyers Association

Emily S. Yu, Secretary of the Intellectual Property Law Section of the California Lawyers Association and Chair of the Technology, Internet and Privacy Interest Group

1st Annual California Lawyers Association Meeting – September 14-15, 2018 in San Diego!

OK – get out your playbooks:  Last year, The Sections were still part of the State Bar of California, but our annual meeting was separate from the Bar and was called the “1st Annual Calbar Section Convention“.  On January 1st, 2018, the Sections were spun off into our own entity, the California Lawyers Association (CLA) – and with a new entity comes a new event name:  The “California Lawyers Association Annual Meeting”.  Got all that?

So, I’m dropping by to tell you that I’ll be presenting a one-hour program in San Diego at 3:10 pm on Saturday, September 15th with my colleague from the California Young Lawyers Association, Michael Iseri:

Program 42:  Legal Cyber Security:  Best Standards and Practices for Law Firms

Keep an eye on the CLA’s page for the event for further details.

1st Annual Calbar Section Convention – August 18-19, 2017 in San Diego!

2017-08-18_section-convention

You may have noticed that I don’t post much anymore.  However, I’d like to mention that yours truly will be presenting a program at the convention:

Date: Friday, August 18, 2017
Program Time: 10:30 AM – 11:30 AM
Program Number: 9
Program Title: Using Technology in Trial to be Persuasive and Stay Organized
Speakers:
Jeffrey Bennion and Perry Segal

Now, in the spirit of continuing my new tradition, I’m posting the information and links verbatim.

Section Convention

The Sections of The State Bar of California are pleased to announce plans for the inaugural Section Convention on August 18 and 19, 2017 in San Diego.

August 18-19, 2017
Sheraton San Diego Hotel & Spa
1380 Harbor Island Drive
San Diego, CA 92101

Earn 12 Hours of Participatory MCLE Credit, Including Legal Ethics and Competence Issues

Thirty-six  education programs, all approved for MCLE credit.

Hundreds of California lawyers, judicial officers and legal staff in attendance.

Much more is planned, so save the date.  Details will be published at Section Convention soon!

Guest Post – John Sadler: What Can You Learn About Teamwork By Playing in a Band?

John Sadler - Teamwork PNG

As a (former, recovering, retired) musician, I relate to this post by my friend, John Sadler:

Playing music in a band is a team activity that can be complicated by the ego issues and creative preferences of the band members, as well as role ambiguity. Over many years of playing music with other people, I’ve learned some behaviors that help a group work well together musically, and others that can make it fall apart. Many of those lessons port nicely to other team activities.

The biggest element of success in a band is to show respect for your bandmates. Other necessary conditions include:

Show up, on time – Clarinetist (among other vocations) Woody Allen has been quoted as saying that “Eighty percent of success is showing up”. It’s important to be dependable and do what you say you’re going to do. It’s equally important to pick bandmates who do the same.

Come prepared and in tune – don’t waste your bandmates’ time by playing your part poorly or wrong if you could have practiced it beforehand. Similarly, nobody wants to stand around while you set up and tune your instrument. If you have a complex kit, show up early and be ready to go when everyone else is.

Listen to the band – not just yourself. A great bandmate is a great listener, and will adapt his or her performance to make the band sound as good as possible. There is a lot to this. When you accompany, your job is to make the soloist sound great. What you don’t play is at least as important as what you do play. Leave space! (AKA silence). Get used to hearing yourself in the context of the band to get a feel for the right volume level. If you’re accompanying a soloist or a singer, make sure you’re not too loud – you may even lower your volume so the featured performer stands out in the mix. What sounds like the right volume when you practice may be way too loud in the context of a band. When you solo, you need to be a bit louder; more importantly, others need to back off. If in doubt. record the performance and listen carefully.

No drunks, no jerks – it’s hard enough to make great music without impairing your ability to think and perform. Give yourself every chance to have sound judgement and the best possible control over your actions. Check your ego at the door as much as possible – there needs to be honest give and take to make great music. You may think that you are a creative genius, but the odds are against it. Few team efforts are improved by verbal abuse, ego games, or infliction of emotional distress. A great band can rise above the limitations of its individual members if everyone is working well together.

Take mistakes in stride – the audience notices how you react to mistakesmuch more than the mistakes themselves. It’s OK to make a mistake. It’s not OK to call attention to it while performing. If someone makes a mistake (and everyone will) during practice, keep playing and have a critique at the end of the song. Remember that you will make mistakes as well – treat people kindly. They’re supposed to be your friends.

Everyone should have a chance to contribute ideas to improve the sound and performance. Everyone should be able to try ideas, especially during practice, that might result in a better sound. So mistakes have to be OK in order to perform at the highest possible level.

Expecting mistakes to happen and handling them with grace is a huge life skill. As bassist Victor Wooten points out in his excellent book The Music Lesson, a “good” note is never more than one fret away. Did you know that you can practice recovering from mistakes, the same as an astronaut practices dealing with emergencies?

Discuss and align your goals together – this one issue is responsible for the demise of many bands. You and your bandmates must agree on goals, whatever they may be, in order to form a cohesive team. If one person needs income or commercial success while the rest want to jam on the porch on a Sunday afternoon, you have a problem. You must decide what kinds of music you will play, what the roles of the members are – to name a few:

  • Who selects the material?
  • Who is the band leader?
  • How many soloists or lead singers are there?
  • Who are the song writers?
  • Who buys the beer? (Just kidding)

Finally, a couple of ideas for performance:

Play it the way you practiced it – Conversely, if you practice poorly, you will perform poorly. Good practice skills are highly underrated! Here’s one pointer that is easy to miss and hard to learn, but works exceptionally well: go slow to go fast. Practice only as fast as you can play smoothly and without mistakes. Speed up the tempo gradually. If you practice too fast, you will be teaching your muscle memory to make mistakes, and you will never play your part well. This general principle applies to almost any physical activity.

By the way, most great soloists practice their solos. Really. They don’t just step up and fake it unless they have to. Yes, there are exceptions, but I’ll bet they worked very hard to become exceptions.

Don’t stop until the song is over – Starting and stopping together are the second steps to sounding like a band (the first step is to play the same song together in the same key and tempo). You need to agree as a band on how you will know the song and tempo, how it will start, and how you will know when to end it. These things do not happen by magic. They happen by agreement, by knowing the material cold, and possibly by years of playing together.

Those are a few lessons I’ve learned the hard way by playing bands since I was a kid. I think many port nicely to the workplace. What do you think?

************************************************

About the Author

Reprinted by Permission.  Photo credit: Tomasz Budzyński.

Guest Post – Peter N. Brewer: LegalTech – Day Two

Peter Brewer Caricature

I think this is the first time I've ever done this on the blog, but immediately following LegalTech, I had to leave for a trip.  However, Peter Brewer, my trusty colleague from the Law Practice Management & Technology Section, was kind enough to write up a guest-post about his experience this year.

<<< I leave it to you to determine which image to my left is the real Peter Brewer:

"The ALM LegalTech West Coast event, historically always venued in the Los Angeles area, was held instead this year in San Francisco at the Hyatt Regency on July 13 and 14. As in the past, the event consisted of keynote sessions, seminars, and importantly, a large vendor exhibit area. The first day had five seminar tracks running consisting of; corporate legal operations, information governance, advanced IT, the cloud and mobile technology, and E discovery. The second day the tracks were four in number and consisted of; information governance, E discovery, information technology, and corporate counsel perspectives. 

I attended only the second day, which kicked off with an interesting discussion of the Ellen Pao versus Kleiner Perkins Caufield Byers case. On the panel were two reporters who covered the trial, and the defense attorney, Lynne C. Hermle, from Orrick Herrington and Sutcliffe. The plaintiff’s attorney, Alan B. Exelrod, of Rudy, Exelrod, Zieff & Lowe, had been scheduled to be on the panel but had to withdraw due to a scheduling conflict. This keynote proved to be a lively hour of informal discussion in which Lynne Hermle gave substantial credit to the jury for their thorough and diligent evaluation of the evidence. 

The keynote was followed by seminar sessions throughout the day, with ample breaks to visit the vendor exhibit hall.  I attended one of the seminar sessions on E discovery, “Every day E discovery: Bringing It In-House or Outsourcing It.” The panelists were knowledgeable; they consisted of an independent consultant, a claims manager, a partner from the major law firm, and a representative of Lexis-Nexis. The discussion was lively, but for my tastes it was a broad overview with much discussion of the concepts but very little grass-roots, take-home practical advice. I came away feeling that the discussion had been thoughtful, but with no better sense of, “where do I start,” or “what are my first steps when I get back to the office.” 

I also attended a session on cyber security. Again, the panelists were well qualified and knowledgeable. The discussion included such things as the availability of data breach insurance, engaging outside consultants to do cyber security audits of your business, and a general, high-level discussion of the topic of data security in the office. Toward the end of the session the moderator opened the discussion up to questions from the audience. I commented to the panel that, while I found the discussion interesting, I would like to have some specific action items that I could take back to my five-attorney law firm and implement, step-by-step. 

The advice that was given in response was to start with written policies and procedures. As in any endeavor, if you don’t know where you’re going, any road will take you there. A cautionary bit of advice that went with the suggestion of developing written policies and procedures was that then you are duty bound to follow them. Failing to observe your own procedures can increase rather than decrease your liability.

It was also suggested that I consider hiring a security consultant to do a risk assessment of my office. Apparently for a firm the size of mine (<10 total staff) this endeavor can run approximately $5,000 – $10,000. While this seems like a sizable chunk of discretionary spending, the cost of a data breach and one’s exposure to liability for it would no doubt be a multiple of many times that amount. 

Contrasting the 2015 event with LegalTech events in years past, one significant difference stood out to me.  In past years there were seminar sessions on a broader variety of topics. There have been sessions on such things as what financial reports a law firm owner should regularly produce and review, sessions on tech gadgets, useful mobile devices, helpful apps, practice management software, and so forth. This year by far the greatest emphasis was on data. Even the vendor exhibit hall, although it did have exhibitors of a variety of useful products, seemed to be heavy on the e discovery and data security vendors. While this information is no doubt useful to some, I found it not very applicable to my small firm’s real estate law practice, where we do not get cases involving discovery of tens of thousands, or more, documents. Circling back to the keynote discussion that kicked off that day, attorney Lynne Hermle said that in the Ellen Pao vs. Kleiner Perkins case Ellen Pao had produced something approaching a million documents. May I be blessed to reach the end of my career without ever having to tackle such a daunting task. 

All in all, the LegalTech event is an enjoyable break from the office, especially for those of us interested in tech.  Are you one of us?  Check your wrist.  If there’s an Apple watch on it, you are inescapably a techie.  It was nice to have this event in Northern California for a change, and the Hyatt Regency was a lovely and accommodating venue.  I hope to see the event back in San Francisco again next year."

Peter Brewer

************************************************

About the Author:   Peter N. Brewer has been a lawyer for over 35 years, and is also licensed by the California Bureau of Real Estate as a real estate broker.  Peter started his own firm in 1995.  The firm has grown to five attorneys, practicing real estate and lending law.  The firm serves the legal needs of homeowners, purchasers and sellers, real estate and mortgage brokers, agents, brokerages, title companies, investors, other real estate professionals and their clients. Peter and his firm also represent clients in debt collection, creditor representation in bankruptcy, breach of contract matters, and other litigation and transactional work.

Peter obtained his Juris Doctor degree from the University of Santa Clara Law School in 1979 and is also licensed to practice law in all State and Federal Courts in Idaho and certain Federal Courts in Michigan and Iowa (and probably in other states he no longer recalls).  He loves dogs, hates kids, and is generally considered to have an insufferable disposition.

Law Offices of Peter N. Brewer

2501 Park Blvd, 2nd Flr.

Palo Alto, CA 94306

(650) 327-2900 x 12

www.BrewerFirm.com

BayAreaRealEstateLawyers.com                 

Real Estate Law – From the Ground Up®

My Analysis of Calbar Formal Opinion 2015-193: eDiscovery & ESI? “Don’t Be Stupid”

The last three words from this short Beverly Hills Cop video clip sum up my analysis of the opinion:

I wrote public comments to COPRAC (The State Bar of California Committee on Professional Responsibility and Conduct) re their interim versions of the opinion and, in a rare step, I’m posting a verbatim excerpt because my assessment of this opinion remains unchanged.  One modification – I bolded a quote, because the Committee adopted my definition verbatim in their opinion (page three, footnote six):

“I’m seeing a very common thread in COPRAC’s reasoning that afflicts those who understand technology at a more surface-level; the tendency to think of it in physical, rather than ethereal terms.  In other words, the Committee has focused on the word evidence, instead of the word electronic.  Take water, for example.  Whether it exists in a lake, a bathtub, or a glass, it’s still water.  It’s the same with evidence.  Whether it exists as writing on a tombstone, a paper document, or in electronic form (e.g. sitting on a flash drive), it’s still evidence.  It’s the medium that should distinguish it for your purposes.  That’s the contrast missing here.

Whereas the Committee has done a better job of defining parameters such as clawbacks and laying out accurate mistakes by our hapless attorney, once again, it descends into conduct that isn’t eDiscovery-based; but competence-based.  This opinion relies too much on unrelated reasoning, such as “assumes”, “relying on that assumption” and “under the impression”.  That’s not an eDiscovery problem; that’s a general competence problem.  It’s also not what the audience needs.  If they’re attorneys licensed in California, they’ve presumably passed both a Professional Responsibility course and the MPRE exam and know – or should know – their duty of competence.  It’s not as if an attorney retains a med-mal case, then immediately “assumes” or is “under the impression” that s/he’s a doctor and can read an x-ray.  But I could intertwine those facts with this opinion and make it about medical experts.  What attorneys specifically need to know is how their actions, or lack thereof, in the procurement, assessment and handling of electronic evidence morph into a violation.  This is a highly specialized area unto itself.  See my previous example.  The x-ray is electronic evidence.  Proper acquisition is one matter; analysis, forensic or otherwise, is quite another.  That doesn’t just include the adversary’s evidence.  It also includes the Client’s evidence.  In this scenario, one is seeking to exculpate the Client through all available means – not just via the adversary.

Contradictions also exist in Footnote Six on page three that states, “This opinion does not directly address ethical obligations relating to litigation holds.”.  I respectfully submit that the opinion goes on to do exactly that.  Perhaps this is due to the criteria set forth in Footnote Six being inaccurate as defined.  In a legal setting, Attorney is charged to know what the Client does not, and this may involve issuing litigation hold instructions to their own Client; not just third parties or adversaries.  If attorney was interacting with the CIO or CTO (The “Information”/”Technology” chiefs, perhaps s/he could reasonably reply on their assessments.  But here, attorney is interacting with the CEO who likely has no intimate knowledge of what goes on in the IT department.  It should read, “A litigation hold is a directive issued to, by or on behalf of a Client.”  Otherwise, how does the competent Attorney protect a Client who, in good-faith, endeavors to do the right thing or protect themselves when a Client, in bad-faith, engages in intentional spoliation?  One of those scenarios exists on page two, when the eDiscovery expert, “tells Attorney potentially responsive ESI has been routinely deleted from the Client’s computers as part of Client’s normal document retention policy”.

Understanding these nuances and acting on them is the very definition of competence as applied to an eDiscovery attorney – or an attorney who engages the services of a third-party eDiscovery vendor.  In this arena, eDiscovery is like a game of falling dominos; once competence tips over, the rest (acts/omissions, failing to supervise, and confidentiality) will logically follow.  As they say, timing is everything.”

Conclusion:  The opinion does a good job of explaining fundamentals of the eDiscovery process, but in my opinion, doesn’t go nearly far enough.

Calbar CYLA Symposium – May 22, 2015 in L.A.

CYLA Skills 2015So…I'm a little out of order (not a great thing for a lawyer to say, is it?).  It means that I've already posted presentations in June but the CYLA Annual Practical Skills Training Symposium is held in the State Bar offices May 21st in San Francisco and May 22nd in Los Angeles.

Two important thing to know:  1) The programs are different each day, and 2) I'm presenting from 2 p.m. – 3 p.m. Friday, May 22nd on:

 

New Attorney Skills (Attorney Advertising) 

Ethical Attorney Advertisement and Marketing

"This course will discuss how to advertise your legal services on the Internet. Learn how to design and operate your website, correspond with clients or prospective clients online, and use social media to maximize your business objectives."

I'll also be sticking around from 5:30 p.m. – 6:30 p.m. for:

Networking Speed Mentoring

"Meet and greet seasoned legal practitioners."

I'm pretty sure "seasoned" is a euphemism for "old"…I'll pretend it means, "experienced".

I hope you can join us.

Calbar Solo Summit – June 18-20, 2015

Solo Summit 2015It’s that time again, folks.  The State Bar of California Solo and Small Firm Summit will be held at the Newport Beach Marriott from June 18-20, 2015.  I’m presenting program ten this year on Thursday, June 18:

 

Earth(quake), Wind, Fire & Flood: Disaster Planning for the Law Practitioner

Four things are certain in life: death, taxes and disasters. The fourth? The disaster won’t manifest itself in the way you expect nor when you expect it. This program broadens your perception of what a disaster is and – should one occur – guides you through preparing and planning for continuity in your law practice.

I’ve been a fan of this conference for years because it provides a more intimate experience between attendees and presenters.  I hope you join us this year!

LTWC 2015: From LA to SF!

 LTWC 2015
Have you heard?  Big changes are afoot for Legaltech West Coast 2015:

  1. The dates are July 13-14, 2015
  2. It's relocated to the Hyatt Regency
  3. That's the Hyatt Regency…in San Francisco!

How accommodating of them to move it to my new city.  I didn't realize I had that much pull.  Actually, it was great news when I found out about it a few weeks back because in 2014, I had to skip the conference for the first time in years – and it was looking the same way for 2015.

Registration is open.  Mark your calendars…and see you there!

The Exchange: Cyber Security

TGCIHot on the heels of Today's General Counsel and Institute's eDiscovery-based, "The Exchange" comes something new:  "The Exchange: Cyber Security.  This is not a 'tour'; it's only held in two locations.  Thankfully for me, one is – once again - at The Bar Association of San Francisco, April 27-28, 2015.

Any guesses where the second one will be held?  Hmmm….where is this kind of thing prevalent?

Washington, D.C., of course!  That conference isn't until November 2015 – you have time.

I attended most of day one of The Exchange yesterday and it's as robust as ever.  Still a great choice if you want to get the big-picture view from every corner of our profession. 

Registration is open, but be warned; it's almost completely full and the rules are different this time.  You may use the same free code to register if you're my corporate readers only:

TGCICOMP

Sorry law firms – you still have to pay.  Also, this is a vendor-sponsored event, so no outside vendors allowed.  

P.S.  I'd like to give a shout-out to my good friend from TGCI, Neil Signore, who has graciously provided complimentary admissions.