By: Jeff Embleton
The new General Counsel of the National Labor Relations Board, appointed by President Donald J. Trump, rolled back controversial handbook rules promulgated under the Obama Board. General Counsel Peter Robb has announced new guidelines on interpretation of handbook policies and rules. These new guidelines overturn a number of controversial decisions under the Obama Board that found facially neutral policies unlawful because of a “possible” chilling effect those rules might have on employees’ rights under Section 7 of the National Labor Relations Act. The new guidelines give greater clarity to businesses, HR professionals, and legal advisors who are responsible for writing, maintaining and interpreting handbook policies and rules. The Memorandum issued by Robb specifically repudiates the former General Counsel’s attack on employer handbooks which resulted in increased enforcement efforts against businesses for handbook violations. A white paper describing the Memorandum is available here for further review.
By: Jeff Embleton
WHITE PAPER
Continuing an effort to reverse or modify many of the employee and union-friendly policies promulgated by his predecessor, the NLRB’s General Counsel, Peter Robb, announced new guidance on handbook rules and policies following the NLRB’s decision in the Boeing Company (2017).
Many employers may recall that the former General Counsel of the NLRB, Richard Griffin, issued GC Memorandum 15-04 in March 2015 which resulted in most employers having to carefully review and revise handbook rules and policies in response to the Memorandum. Griffin’s Memorandum also resulted in increased investigation enforcement activities by the various Regional Offices of the NLRB involving handbook rules and policies. Specifically, in the GC Memorandum 15-04, the former General Counsel, following the Board’s decision in Lutheran Heritage Village – Livonia (2004) decided to emphasis the first prong of the three prong test announced in Lutheran Heritage:
Even if a rule does not explicitly prohibit Section 7 activity, however, it will still be unlawful if (1) employees would reasonably construe the Rule’s language to prohibit Section 7 activities; (2) the Rule was promulgated in response to union or other Section 7 activity; or (3) the Rule was actually applied to restrict the exercise of Section 7 rights.
Indeed, the new emphasis on the first part of the Lutheran Heritage standard resulted in number of enforcement charges against even facially neutral rules if the rule “could” be interpreted to have a chilling effect on employees and Section 7 rights.
However, under the Robb Memorandum, the new General Counsel said two very important things: (1) since the repudiation of the first prong of Lutheran Heritage in the Boeing Company case, the focus will now be on balancing the Rule’s impact on the employee’s ability to exercise their Section 7 rights and the Rule’s connection to the employer’s right to maintain discipline and productivity in the workplace; and (2) the Regions have been directed that ambiguities in Rules are no longer interpreted against the employer. In essence, the new guidance moves away from prohibiting rules that could be interpreted to impact Section 7 rights to reviewing the rules that would impact Section 7 rights. The Memorandum further described the three categories of Rules and how they will be reviewed:
Category 1. Rules that are Generally Lawful to Maintain.
The Memorandum directs that these Rules are generally going to be considered lawful either because the Rule does not prohibit or interfere with the exercise of Section 7 rights or because the potential impact on Section 7 rights is outweighed by the business justification associated with the Rule. Interestingly, the Memorandum spends most of its focus on providing guidance on rules that will be considered lawful, even if they could cover Section 7 activity. Those Rules include:
Again, it is important to note that Category 1 Rules will be deemed to lawful on their face which is a change from the previous General Counsel’s interpretation. However, keep in mind that even facially neutral rules can result in violations of the NLRA if improperly applied.
Category 2. Rules Warranting Individualized Scrutiny.
In describing this Category, the Memorandum gave several examples of rules that would require additional scrutiny to determine the legality of the rules. Examples include: rules regarding disparagement or criticism of an employer (as opposed to rules that prohibit disparagement of employees), rules generally restricting employee’s right to speak to media or third parties (as opposed to a rule that prohibits from speaking to a media on behalf of the employer), rules prohibiting making false or inaccurate statements (as opposed to rules prohibiting making defamatory statements).
These rules are more difficult to define, but also tend to be much broader in their context. These likely will be decided on a case-by-case basis.
Category 3. Rules that are Unlawful to Maintain.
This Category considers rules and policies unlawful that would prohibit or restrict protected activity under the National Labor Relations Act and where they impact on the Section 7 rights outweighs any business justification. Specifically, these rules include:
CONCLUSION
The General Counsel’s newly issued interpretation promises to offer clarification for employers and organizations and a clear road map for professionals who write and interpret these policies and rules. We think this also continues the trend under the Trump Board of pulling back and overturning many of the Obama Board decisions which favored employee and union rights over rights of employers. However, we invite everyone to stay tuned as these cases unfold before the NLRB.
For months, you likely have been seeing articles or receiving e-mails on the topic of the European Union’s (EU) new privacy regulations, termed the General Data Protection Regulation (GDPR), which go into effect on May 25th. You may have skimmed them, or you may have hit “delete,” thinking they don’t apply to your small business. But are you sure?
The GDPR is designed to improve and harmonize data privacy laws across Europe, and will apply in each of the EU’s 28 member states. Unlike its predecessor law, however, the GDPR’s obligations extend to any U.S. company that handles the personal data of EU citizens. This would include, for example, any U.S. company that has an Internet presence and markets its products or services over the web, regardless of whether a financial transaction or sale takes place. So if your company collects “personal data” of an EU citizen even as part of a marketing survey, for example, then the data would have to be protected pursuant to the GDPR. And personal data can be something as simple as someone’s name, e-mail address or mobile device ID.
Along with the GDPR’s increased territorial scope, there are also other key changes that U.S. companies should be aware of:
Consent – The requirements for consent to collect personal data have been strengthened. Any request for consent now must be given in an intelligible and easily accessible form, and must be clear and distinguishable from other matters. It also must be as easy to withdraw consent as it is to give it, and once consent is withdrawn, any “data subject” (the person whose data is being collected) also has the right to have his or personal data completely erased.
Rights of data subjects – A data subject now has the right to ask for confirmation that their personal data is being processed, where, and for what purpose. Further, any data subject can request, and a company must provide, a copy of the personal data to him or her, free of charge, in an electronic format. Additionally, notification of a data breach will become mandatory if the breach is likely to “result in a risk for the rights and freedoms of individuals.” Under that scenario, notification must occur within 72 hours after a company becomes aware of the breach.
Penalties – Last but not least, the maximum fines for the most serious infringements are steep. Companies in breach of the GDPR can now be fined either (1) up to 4% of their annual global revenue or (2) up to €20 Million (approximately $24 million USD), whichever is greater. Second tier fines for lesser offenses could be either (1) up to 2% of a company’s annual global revenue, or (2) up to €10 Million (approximately $12 million USD).
While all of this may seem imposing, the reality is that many small companies can comply with the GDPR’s regulations simply by having a good plan in place. What are three basic steps to take?
For a more in-depth look at the GDPR, please click here to access a more comprehensive publication on the topic. If you have any questions, or would like to discuss the applicability of the GDPR to you or your company, please do not hesitate to contact Jennifer Horn, Brendon Friesen or Ed Patton in our Corporate Law and Business Services Group at (216) 523-1500.
In less than three weeks, the new General Data Protection Regulation (“GDPR”) will go into effect. Are you ready? More importantly, do you understand what the GDPR means and whether (or how) it might affect your company?
Starting on May 25, the GDPR will apply in each of the European Union’s 28 member states. The GDPR’s aim is to protect all EU citizens from privacy and data breaches in a world that has changed significantly from 1995, when the original Data Protection Directive was implemented. But while the new GDPR is designed to improve and harmonize data privacy laws across Europe, its obligations now extend to any U.S. company that handles the personal data of EU citizens.
KEY CHANGES
With new requirements on everything from data subject consent and breach notification to appointment of data protection officers, the GDPR isn’t a regulation to be taken lightly. Its major changes are as follows:
TERMS TO KNOW
Although the GDPR’s terminology is not new, its increased scope means that many more companies must understand what everything means. Here are some of the key phrases explained:
WHAT SHOULD YOUR COMPANY DO?
Any U.S. based company with a large global presence – the type of business that handles a large amount of personal data of EU citizens and could face the stiffest fines for non-compliance – has been working for months to get its policies and procedures updated to comply with the GDPR. But GDPR regulations aren’t only for multi-national corporations. What if you have a small company that might sell into Europe from time to time, or what if your business does market goods or services to EU citizens?
1. Determine Your Role
First and foremost, determine what type of data your company might be collecting, and from where it is gathering the data. The GDPR applies to all companies that process the personal data of data subjects residing in the EU when the data is collected, regardless of the company’s location. For EU citizens who are outside the EU when their data is collected, though, the GDPR would not apply.
What does this actually mean? Not only does the GDPR pertain to any U.S. company that regularly does business in Europe and stores or processes data of EU citizens, it also applies to any U.S. company that has an Internet presence and markets its products or services over the web, regardless of whether a financial transaction or sale takes place. So if a company collects “personal data” of an EU citizen as part of a marketing survey, for example, then the data would have to be protected pursuant to the GDPR. The one caveat is that a company would actually have to target a data subject in an EU country. Passive marketing – where someone might just come across the company’s website by chance and fill out a form – does not count. But “targeting” can take a number of forms, including: using any language of an EU country on the website; offering to deliver goods to the EU; or using a URL that incorporates an EU member state’s domain. In other words, it might be better to assume that your company could be subject to the GDPR and put a compliance plan in place.
2. Determine What Your Obligations May Be
If the GDPR applies to your company, the next step is to determine whether you would be considered a “data controller” or a “data processor.” Generally speaking, a party that handles personal data on behalf of the data controller is known as a “data processor.” This could include anything as seemingly insignificant as, for example, storage of personal data on a third party’s servers. Control, not possession, of personal data is the factor that determines whether a party is a “data controller.” The data controller is the person (or business) who determines the purposes for which, and the way in which, personal data is processed. It is possible, in certain instances, for a company to be both.
Under the GDPR, “data controllers” are required to do the following:
3. Prepare Accordingly – But Err on the Side of Caution
While some U.S. companies will want, or need, to appoint a Data Protection Officer (DPO), for others, GDPR compliance may not be as involved. The key point here, though, is “plan.” Much of a company’s compliance with the GDPR can take the form of an appropriate compliance plan for the personal data it is collecting. Human Resources, IT and either in-house or outside legal counsel should work together to create or update policies. Make sure data collection, retention and security policies address the key points of the GDPR – including how to update website content to clearly obtain consent – and that an incident response plan is in place to respond to a breach. Furthermore, follow up with any employees who may be involved in any of these activities and ensure they are appropriately trained to follow whatever plans are implemented. All of these actions can help mitigate the amount of a fine if a company is found to be in violation of the GDPR.As an example, let’s say a small U.S. manufacturer did some business in the UK* but was hoping to increase its customer base there. So, it created content on its webpage that specifically marketed its products to UK citizens, and set up a way to collect e-mail addresses of prospective UK customers who were interested in more information. At a minimum, the company would have to make sure that its webpage had an obvious “check the box” feature for consent. The company also would have to include clear language on the website about what it would be doing with the e-mail addresses, and it could not ask anyone to click on a separate link containing a long, complicated “terms and conditions” document. Then, the company would also want to take a look at its internal policies, to ensure that collected personal data was handled properly and kept secure – and, that the appropriate employees knew what to do if a data breach was discovered. (*Note: While the status of the United Kingdom as a member of the EU is up in the air, even if “Brexit” goes through, the UK has indicated it will still comply with the GDPR).
4. Prepare for “Data Subjects” to Make Requests Concerning Their Data
As discussed above, a data subject has the right to obtain information from a company as to whether personal data concerning him or her is being collected, why it is being collected, and how it is being stored. In other words, at any time, a customer can request a copy of this information, and a company must provide it free of charge in an electronic format that is easy to read. The data subject also has the right to withdraw consent to having his or her information collected at any time, and a company must make the procedure for withdrawal as easy and obvious as it is to give consent. It also must make sure a data subject knows how to withdraw consent before he or she ever gives consent in the first place. And once a data subject withdraws consent, the data subject has the right to have his or her personal data erased completely. Companies need to ensure that they can be responsive to any request, whether it is to provide information to a data subject, or to erase any information on a data subject completely.
WHAT ARE THE PENALTIES FOR NON-COMPLIANCE?
All of the factors listed above should help alleviate a company’s concern – particularly smaller companies that are still trying to figure out how the GDPR may apply to them – that it will automatically be paying millions of dollars in fines for an unintentional violation. But while it remains to be seen exactly how the GDPR will be enforced, the new regulation makes it very possible that a company could find itself paying a hefty fee if it doesn’t take compliance seriously.
Ernie Mansour was named one of Crain’s Cleveland Business’ “Eight Over 80” published in the April 30th edition. The magazine acknowledged Ernie and seven other individuals over 80 that have made a significant difference in Northeast Ohio. As discussed in the article, Ernie and fellow law school classmate, Mike Gavin, started Mansour Gavin after graduating from Western Reserve University more than 60 years ago.
Ernie has no plans or desire to slow down. His philosophy is to “decide to retire when it doesn’t become fun to do what you’re doing.” To read the full article click here.
To send a congratulatory note to Ernie click here.
Tony Coyne will be a presenter at the Eminent Domain Institute’s program in Columbus, Ohio. The two-day conference will feature an overview of Eminent Domain Law and Policy, Mediation, Jury Selection, Trial Strategy, Quick-Takes and more. The Program will consist of attorneys, mediators, government officials, and appraisers to share their experience and knowledge on eminent domain topics. Tony, along with Michael Braunstein and Scott Phillips, are Co-Chairs of this Conference.
EVENT DETAILS:
Eminent Domain Attorney-Appraiser Collaboration
When: May 17-18, 2018
Location: Renaissance Downtown – Columbus, OH
Tony Coyne is the firm’s President and a member of Mansour Gavin’s Real Estate and Land Use, Corporate and Business Law and Environmental Law practice groups where his practice is focused on business law, municipal law, zoning and planning, eminent domain, real property and litigation.
For more information about the Conference or to register click here.
Attorney at Law magazine named Mansour Gavin Shareholder Chuck Brown as attorney of the month. Chuck has had a celebrated career in law and in Cleveland — did you know he served first as a magistrate, then as a chief magistrate, then as a probate court mediator before he joined our firm?
In the article, Chuck talks about his experience in probate law, saying: “I never planned on specializing in probate until the opportunity presented itself. As I gained a deeper understanding of probate law, I realized this specialty impacts a vast number of people and can be highly complex and nuanced.” He also talks about why Mansour Gavin was such a good fit for him considering his strengths in probate law and the attorneys we have to support that practice and work as a team. Read the whole article here. If you have questions, please contact Chuck Brown at cbrown@mggmlpa.com.
Ed Patton’s talk titled, “Documentation for Export Compliance,” is intended to develop a working knowledge of export documentation for export transactions and related activities, including export licenses/applications and required supporting forms, certifications and other information, export shipping, item classification, customer screening and required recordkeeping. The seminar is tailored for compliance officers, business development executives, and managers and associates in sales, customer service, and shipping.
EVENT DETAILS
When: Thursday, February 15, 2018
Time: 7:30 am – 12:00 pm
Location: Paradigm Center (Mentor Schools – 6465 Center St., Mentor, OH)
Ed is a member of Mansour Gavin‘s Corporate and Business Services and General Civil Litigation practice groups. With extensive knowledge and experience about corporate compliance programs, Patton will share insightful, practical strategies.
To find out more about the seminar or to register click here.
Mansour Gavin is a proud sponsor of the Up Side of Downs’ Sunburst Gala – A Night to Celebrate and Shine. The event will be held on Saturday, March 10, 2018 at the Cleveland Marriott Downtown at Key Center. The Up Side of Downs exists to provide support, education and advocacy for people with Downs syndrome, their families and communities throughout Northeast Ohio.
For more information about this Gala or to purchase tickets to attend the event, contact USOD Board Member Mickey Quinlan at Mansour Gavin or click here to visit the Up Side of Downs website.
AN INFORMATIONAL PRESENTATION AND PANEL DISCUSSION FROM MANSOUR GAVIN LPA’S CORPORATE AND BUSINESS SERVICES GROUP
Gain insight and practical guidance to advance your intellectual property business goals – whether you want to determine value for a potential acquisition or sale, or learn how to best protect your IP.
* * * * * * * * * * * * * * * *
When: February 14, 2018, 8:30 a.m. to 10:00 a.m.
Where: North Point Tower, 1001 Lakeside Ave., Cleveland (Lower Level, Executive Conference Room)
AGENDA
8:30 a.m. Registration, networking, and Continental breakfast
9:00 a.m. Panel presentation and discussion on IPA valuation and protection, with Karl Maersch, Principal of West Four IP Consulting Group, and Brendon Friesen and Jennifer Horn, Mansour Gavin business and IP attorneys
9:45 a.m. Q&A/conclusion
* * * * * * * * * * * * * * * *
Everyone interested in learning more about the importance of IP rights in business should attend. We look forward to seeing you there!
* * * * * * * * * * * * * * * *
Register by Monday, February 12, 2018, by contacting Diane Barna at dbarna@mggmlpa.com or 216-523-1500. There is no fee to attend this program. CLE approval pending.
Parking at North Point Garage (entrance on E. 9th Street) will be validated. Please bring your ticket to the program.