contracts & communication · • a broad release for all types of media, whether now known or...

CONTRACTS & COMMUNICATION:Anticipating Risk and Effectively

Communicating with the Business

Presented by:

Kelly Whitehart, Lynda Jensen, & Mark Sullivan

Moderated by:

Peter Haley

Keys to Being Responsive to the Business Through Contracts and Communication

1. Critical Contract Terms and Provisions:

• Social media;

• FTC Compliance;

• Geofencing and Privacy;

• FCC Compliance and TCPA;

• Privacy/cyber;

• GDPR;

• CCPA and Others.

2. Communicating the urgency of these provisions, conveying change and persuading the C-Suite:

• How do you determine urgency and your role in conveying critical contractualrequirements (protect privacy or lose the deal).

• What are the things that matter to your internal reports?

• How do you calculate and convey the business impact of regulatory change?

2

SoLoMo: Social Local Mobile Marketing

• In a world where everyone is connected, consumers turn to socialmedia and mobile devices for more than friend connections.

• As of 2018, more than 63% of all web traffic was mobile.

• According to Statista, currently, there are more than 1.6 billionsocial network users worldwide with more than 64 percent ofinternet users accessing social media services online.

• Social media marketing and advertising, including rich media andonline video, have been constantly on the rise.

3

What Are the Risks and How Do We Avoid Them?

• Legal Risks:

o IP Infringement;

o FTC and State Compliance;

o Privacy; and

o FCC Regulations.

4

Legal Risk: Can We Use That? IP Concerns

• Protecting your own brand is obviously priority number one,but a major risk facing companies in the social media worldis liability for infringement of a third party’s IP rights.

• The rules for print advertising still apply to social media andthe rules for use of trademarks and copyrighted contentremain the same. A good rule of thumb: if it belongs tosomeone else, get approval!

5


USER GENERATED CONTENT

• Following the desire of millennials for an “Authentic relationship,” brands have realizedhow valuable it is to tell their story and advertise their products using genuine imagesshared on social media by real-life customers, either in place of, or in addition to,traditional ads.

• With this shift has come a host of legal questions: when is it ok to use an image sharedto social media? When does a brand need to get permission to use the photo? Andfrom whom? The photographer, the subject in the photo, and the network where thecontent was posted all potentially have a legal claim to content that brands might usefor advertising or other monetary gain.

2 KEY QUESTIONS:

1. Will we profit from using this image? / Does this qualify as an advertisement?

2. Are we taking the content out of the protections of the network’s terms of service?

6


7

Do you need permission?

SIMPLY BECAUSE IT IS ON SOCIAL MEDIA DOES NOT MEAN IT IS FREE TO USE!

• Who owns the copyright?

• Are there any publicity rights to be worried about?

• Are there trademarks in the content?


Scenario #1:

A widely followed Instagram influencer has a thirdparty livestream her shopping experience in aretail store and posts it to her feed tagging thecompany. Can the company share the video on itssocial media platforms?

8


Answer:

Maybe, but first you need clearances.

What do you need?

• A written consent and release from the influencer.

• A written consent and release from any third-parties.

o Is there a copyright associated with the person filming the video?

o Were any other individuals identified (e.g.name, likeness, voice or biographical information)?

o Were any third party trademarks featured?

o Was any third party musical content included?

9


Scenario #2:

While surfing the internet, employee X finds a paparazziphoto of Hollywood Starlet leaving MegaStore Z after ashopping trip. Employee X sends the photo to the socialmedia manager with the caption “Even Hollywood Starletcan’t resist the amazing deals at MegaStore Z.” Are thereany concerns with the company sharing the photo on itssocial media platforms?

10


Answer:

Absolutely!

What legal issues are raised?

• Is there a copyright in the photo?

• Is there a right of publicity for Hollywood Starlet?

o Presently, 22 states (e.g., IL and NY) protect ROP by statute and 38 states recognize the right under common law (e.g., NJ), while some states are silent on the ROP issue.

o CA and other states protect ROP via statute and also afford common law protection.

o Several states, including CA, protect ROP post-mortem as well. In CA it continues 70 years after death, in FL, 40 years after death, and in TN, it's 10 years (or longer with use).

o NY presently recognizes ROP in living persons only.

o Legal remedies for violation of ROP include injunction and monetary damages.

o Even if you have a license to the copyright, you may still have an issue on ROP.

11


Establishing a Right of Publicity claim:

• Does the allegedly infringing use identify the individual?

• Is the use a commercial use?

If the answers are yes, and even if you have a copyrightlicense, you still need consent to use the image.

12


What About In-Line Content?

Brands are increasingly using mixed content forpromotion – a “click to buy” ad mixed among UserGenerated content. If the click to buy ad is not directlylinked to the UGC, is that enough to avoid legalimplications?

• Maybe. This is still a grey area and one that the FTC is likely to hone in on.In essence, burying the ad in other user generated content is essentiallyusing the UGC for a commercial purpose. If that is the case, permissionand disclosure are your best friends.

13

Legal Risk: How Do We Mitigate Risk?

Strong Release Forms!

If you are creating and publishing your own social media and digital marketing content,you need a strong release form that contains the following:

• Clear consent and permission to use the IP, name, likeness, brand, etc.;

• A broad release for all types of media, whether now known or later created(social media changes fast and new platforms come online frequently); and

• Get the right signatures!

o There are two requirements for the signature on a release: it must be“informed consent,” which means that the person signing the releaseunderstood it; and the person signing the release must have the authorityto grant the release.

o In the majority of states, a minor is any person under 18 years of age,although in some states, the age may be 19 or 21. Since a minor may notunderstand the terms of a release, the signature of a parent or guardian isrequired before using a minor’s name or image.

14

Legal Risk: How Do We Mitigate Risk?

Broad Release Form Example

Grant

For consideration which I acknowledge, I irrevocably grant to __________________________ (“Company”) and Company’s assigns, licensees, and successors the right to use my image and name in all forms and media including composite or modified representations for all purposes, including advertising, trade, or any commercial purpose throughout the world and in perpetuity. I waive the right to inspect or approve versions of my image used for publication or the written copy that may be used in connection with the images.

Release

I release Company and Company’s assigns, licensees, and successors from any claims that may arise regarding the use of my image, including any claims of defamation, invasion of privacy, or infringement of moral rights, rights of publicity, or copyright. Company is permitted, although not obligated, to include my name as a credit in connection with the image.

Company is not obligated to utilize any of the rights granted in this Agreement.I have read and understood this agreement and I am over the age of 18. This Agreement expresses the complete understanding of the parties.

Name: _______________________

Date:

Signature:

Address:

Witness Signature:

Parent/Guardian Consent (include if the person is under 18)

I am the parent or guardian of the minor named above. I have the legal right to consent to and do consent to the terms and conditions of this release.

Parent/Guardian Name: _______________________

Date:

Parent/Guardian Signature:

Parent/Guardian Address:

Witness Signature:

15

Legal Risk: Marketing FTC Compliance

The Law

• Authority – 15 U.S.C. § 45:

o (a)(1)Unfair methods of competition in or affecting commerce, andunfair or deceptive acts or practices in or affecting commerce, arehereby declared unlawful.

o (a)(2) The Commission (FTC) is hereby empowered and directed toprevent persons, partnerships, or corporations . . . From usingunfair methods of competition in or affecting commerce and unfairor deceptive acts or practices in or affecting commerce.

• Under this authority in 2000, the “Dot Com Disclosures” werepromulgated, and dealt primarily with applying FTC guidelines to onlinesales and marketing, and email solicitation.

16


• In an attempt to keep up with developing technology, the FTC issued updatedguidance to the Dot Com Disclosures in March 2013.

• Specifically, the new guidance, .com Disclosures: How to Make EffectiveDisclosures in Digital Advertising, took into account the expanding use ofsmart phones and the rise of social media marketing.

• The 2013 guidance made clear that the prohibition against “unfair ordeceptive acts or practices” encompasses social media marketing.

• Additionally, the 2013 guidance sought to clarify when a “clear andconspicuous” disclosure was required to prevent advertisements from beingdeceptive, unfair, or otherwise violative of a Commission rule.

17


Can a Post, Tweet, or Like Violate the FTC’s Prohibition on Deceptive Business Practices?

• Short answer: Yes!

• In 2017, the Federal Trade Commission was extremely active sending out 90warning letters to social media influencers and marketers regarding improperpromotion of products on social media platforms.

• The letters marked the first time the agency reached out directly to educatesocial media influencers themselves. The letters reminded recipients that theymust comply with the FTC’s Endorsement Guides, which ensure that all postscontain the necessary clear and conspicuous disclosures.

• 2018 was considerably less active, however, it remains clear that the FTC willbe focusing on influencers moving forward.

18


• According to Statista, it is predicted that there will be more thanthree billion social media users by 2021!

• Per month, Facebook has 2.07 billion active users with Instagramand Twitter not far behind with 800 million and 330 million activeusers per month respectively.

• Influencer marketing has 11 times the return on investment overtraditional marketing such as print, TV and desktop ads.

19


• With the proliferation of sponsored content in the marketplace, thegrowth of the influencer space and its value, and the ongoing controversysurrounding false news on social media, the commission, some say, is stillplaying catchup on enforcement. It’s not always easy for consumers siftingthrough their social media feeds to immediately recognize that someone isbeing paid for a post or an endorsement, which isn’t fair, according to theFTC.

• While at first, there was much backlash about the FTC requireddisclosures, such as #ad or #sponsored, brands are reporting thattransparency and context actually create a more authentic experiencebetween the consumer and brand, and are actually generating higher ROI.

• Millennials and Gen Z are less likely to buy from a brand using a celebrityendorser as opposed to a micro-influencer with whom they feel anauthentic connection.

20


What Does That Mean for Your Brand and Where Does the FTC Go Next?

• For traditional influencer marketing, the same rules still apply:

o don’t use ambiguous disclosures like “Thanks,” #collab, #sp, #spon or #ambassador;

o #ad placed prominently at the beginning of the text is still the safest option;

o don’t rely on disclosures that people will see only if they click “more;” and

o on image-only platforms like Snapchat, superimpose disclosures over the images.

• The rise of micro-influencers is also creating a rise in User Generated Content andChatbots/Virtual Influencers. Given that the FTC tends to lag behind the trends, itis likely that we will see the next round of enforcement actions focused in theseareas. For that reason, clearance and consent is essential!

21


KEY INFLUENCER MARKETING AGREEMENT PROVISIONS

• Include clear guidelines for disclosures that follow FTC requirements.

o Any violation of this clause shall be defined as a material breach.

• Include detailed Reps and Warranties regarding original content & IP rights.

• Include a detailed prohibition of uses (ex: defamatory, vulgar, harassing, anything that could tarnish your brand).

• Establish final authority before distribution – ensure the Company has the final say in what is shared.

• Establish derivative content rights.

o Who has the final rights to the final product that was shared?

o What happens if a new asset comes out of the campaign?

• Consider requiring Liability insurance – include a clause that says that the influencer will purchase and maintain some sort of liability insurance.

• Have a clear indemnification clause to ensure that the influencer will reimburse the Company for any wrongful conduct if the Company gets sued because of the influencer’s actions.

• Include a hold harmless clause – establish that the violating influencer will make sure that the Company is not held responsible for anything!

22

Legal Risk: Privacy

Geofencing and Regulatory Scrutiny

Geofencing: the use of GPS or RFID technology to create a virtualgeographic boundary, enabling software to trigger a responsewhen a mobile device enters or leaves a particular area.

• Collection and use of personal data is not without risk!

23

Legal Risk: Privacy

• US Regulators are taking action!

o California’s Consumer Privacy Act of 2018 (CCPA) defines “personal information” toinclude browsing and search history and any inferences derived therefrom.

o In 2017, the Massachusetts Attorney General settled a geofencing case involvingtargeted ads sent by an advertiser to women when they crossed a virtual fence atwomen’s reproductive healthcare facilities.

The AG alleged that the advertiser’s use of geofencing violated the MassachusettsConsumer Protection Act because it tracked consumers’ locations and disclosedthat information to third party advertisers to target consumers based oninferences about their private, sensitive medical and/or physical conditions.

o The FTC has also been active in geofencing regulation sending warning letters tomarketers of electronic devices and apps that appeared to collect precise geolocationdata from children, potentially in violation of COPPA.

This action was particularly of note as the FTC issued some letters to companiesoutside of the US stating that the COPPA rules apply to foreign based websitesand online services that are involved in US commerce.

24

Legal Risk: Privacy

How does the increased scrutiny affect marketing?

YOU MUST OBTAIN AFFIRMATIVE OPT-IN CONSENT

• If you are processing locations of smart devices for direct marketing, get clear,affirmative consent.

• The key is transparency: prominent notices in geofencing areas arerecommended.

• Consider “just-in-time” notices that specify the purpose of the tracking, who iscollecting the information, for what purpose, how long the information isretained and how the information is secured.

• Geolocation data is personal information and consent is required.

• Even if you are simply providing the app and interfacing with the user, butyour revenue partner is the one using geolocation data, you are still requiredto disclose.

25

Legal Risk: Privacy

Key Contract Provisions for Location Based Marketing Agreements

• Ensure that all location data used is opted-in and that the consumer isINFORMED that they are opting-in to share location data to serve advertising.

• Ensure data is ALWAYS aggregated and anonymized.

• Do not allow for any individual tracking.

• Ensure location data is not collected from sensitive locations (e.g.: HealthcareFacilities).

• If sensitive location data is used, consumer must provide EXPLICIT consent forthis specific use.

• Include clear indemnity obligations for violation of any data privacy as well ashold harmless provisions.

26

Legal Risk: FCC Compliance

Telephone Consumer Protection Act (TCPA)

• The TCPA primarily regulates:

o The tools telemarketers use to make calls to consumers, such as:

automatic telephone dialing systems; and

artificial and recorded voice recordings;

o The type of telephone line contacted; and

o It covers calls to three types of telephone lines:

Wireless. Wireless lines include residential and business cell phones andother phone services for which the consumer pays for incoming calls.

Landlines. The landlines covered by the TCPA are residential phone lines.

Fax lines. Fax transmissions to both residential and business fax machinesare also covered by the TCPA.

27

Legal Risk: FCC Compliance

Activity Prohibited and Restricted Under the TCPA

• The TCPA places prohibitions and restrictions on:

o Calls that violate a consumer's request not to receive calls;

o Telemarketing calls to residential landlines;

o Telemarketing and informational calls and texts to wireless lines;

o Calls to medical facilities and emergency numbers and calls that interfere with multiple business lines; and

o Telemarketing transmissions to fax machines.

• Prohibitions on calls or texts are affected by whether:

o The equipment used qualifies as an ATDS;

o The correct form of consent is given; and

o The content of the call is telemarketing or informational.

28

How to Mitigate TCPA Risk

• Create and maintain a written compliance policy.

o Clearly outline procedures and policies such as adhering to Do Not Call Requirements,following TCPA prohibitions on calls and texts, obtaining proper consent andmaintaining records in compliance with laws.

o Train employees and vendors on the policy.

o Update the policy frequently!

• Use reputable third party vendors and review the contracts closely.

o Companies can be held vicariously liable for violations made by a third party vendor.

o To limit liability, ensure third party vendor contracts contain:

Reps and Warranties that the third party is compliant with TCPA requirements aswell as any state telemarketing laws; and

Clear indemnity provision to indemnify Company should vendor violate the TCPAor any state telemarketing laws.

29

CyberSecurity and Privacy 101

Understanding the Differences

• CyberSecurity focuses on:

o companies’ policies/procedures/practices/infrastructure designed to prevent unauthorized access to or acquisition of private, confidential and protected information; and

o the ability to respond timely and effectively when data incidents occur.

• Privacy focuses on:

o identifying the private, confidential and protected information about individuals that companies obtain, hold, use and share;

o understanding the justifications for and potential perils in doing so; and

o empowering consumers so that they can give informed consent or opt out of activities surrounding their personal information.

30

CyberSecurity

• Data Events and Breaches.

o Target and its progeny.

• Take stock moment.

• Ensure that incident response plans/written information security program are created.

• Implement technological safeguards.

o Fraudulent activities have evolved and matured; plans to prevent and address them must also do so.

• One-size-fits-all plans no longer work.

• Choose Your Adventure.

• Vulnerability and penetration testing are a must.

• Employee training and table top exercises are your best defense.

• Board reporting and participation.

31

Privacy

• Privacy Laws of Every Manner and Form.

o Understanding the logic behind the laws.

• Substantial amount of personal information gathered on individuals.

• Poor understanding as to what is done with it.

• Empowering consumers by giving them control over the harvesting of their information.

o Navigating the Legal Landscape.

• Internationally.

• GDPR.

• PIPEDA.

• Country-specific and sectoral laws.

• Domestically.

• Privacy regulations or laws in California (CCPA), Washington, Ohio, Texas.

• Biometric privacy regulations in Illinois, Texas and Washington.

• National privacy law on the horizon.

32

GDPR’s Driving The Bus

• GDPR, one year later.

o Became effective May 2018.

o 281,088 cases reported to DPAs in 27 member countries.

• 144,376 complaints focused on right tied to accessing data and preventing processing.

• 88,271 data breach notifications.

o A substantial number of complaints focused on the right to be forgotten and processing of data for marketing purposes.

o Consent/Opt Out.

• Regulatory Enforcement.

o DPOs/IPOs are actively investigating complaint and issuing fines.

o The 4% of gross revenue threat has largely fizzled.

• €56M in fines across 11 countries – enforcement efforts still have teeth.

33

CCPA and Others Jumping On Board

• CCPA.

o Introduced in June 2018 and takes effect January 1, 2020.

o Similar goals and methods to achieve.

• Some meaningful differences.

o Private right of action.

• Others attempts to follow suit.

o Washington – stalled in the state senate; comes to a vote again in 2020.

o Ohio – safe harbor for compliance rather than fine for non-compliance.

o New York – last month introduced in the state senate applicable to anyone doing business in New York.

• Challenges for companies doing business across borders, domestically and internationally.

o National privacy law being explored by Congress since September 2018.

o Google, Amazon and others agree law is needed, but more narrowly tailored than GDPR and CCPA.

34

What’s A Company To Do

• Complying with differing laws presents challenges.

o But core questions underlie each law.

• Understanding the information the company holds.

o What type of information does the company gather?

o For what purpose?

o How long is it held and in what manner?

o Is it shared with anyone? If yes, with whom and why?

o How does the company dispose of it?

o Is informed consent obtained and an opt-out option provided?

• Messaging to individuals/consumers.

o Privacy policies and other disclosure need key language.

o Websites need to be updated with revised cookies disclosures and opt-out buttons before information is required.

35

Takeaways

• General Takeaways.

• Understand what data your company holds.

• Review existing policies/procedures/practices to evaluate whether they are sufficient. in view of developing privacy laws.

• Re-evaluate employee training.

• CyberSecurity Takeaways.

• Review incident responses plans/written information security plans to ensure that they address current trends.

• Perform vulnerability/penetration testing and table top exercises.

• Privacy Takeaways.

• Ensure that privacy policies/cookies disclosures are compliant with the applicable privacy laws.

• Modify webpages to provide opt-out buttons.

• Adjust contract language to incorporate steps to protect private information.

36

Communicating the Urgency of Contract Provisions, Conveying Change and Persuading the C-Suite

• How do you determine urgency and your role in conveying critical contractual requirements (protect privacy or lose the deal)?

• What are the things that matter to your internal reports?

• How do you calculate and convey the business impact of regulatory change?

37

38

Q&A

Lynda R. JensenPartner(617) 217-4639

[email protected]

Contact Information

Kelly L. WhitehartPartner(404) 322-6107

39

[email protected]

Mark E. SullivanConsultant(404) 322-6107

[email protected]

Peter J. HaleyPartner(617) 217-4714

[email protected]

contracts & communication · • a broad release for all types of media, whether now known or...

Documents