The United States and the United Kingdom entered into the world’s first ever Clarifying Lawful Overseas Use of Data Act (CLOUD Act) agreement on October 3, 2019 (the Agreement). The Agreement, which will enter into force later this year after review by lawmakers in both countries, allows each country’s law enforcement agencies to demand, with proper authorization, electronic data regarding serious crime (defined in Article 1 of the Agreement as an offense punishable by a maximum term of imprisonment of at least three years) directly from technology companies based in the other country.
NEWS FOR LAWYERS AND SOURCING PROFESSIONALS
Open Banking is an initiative mandated by the UK’s Competition and Markets Authority (CMA) in 2017. It is intended to facilitate better competition in the banking sector by mandating protocols that facilitate the secure sharing of customer-related data of the nine largest banks in the United Kingdom (CMA9) with third-party providers (TPPs).
Open Banking is developed and delivered in the United Kingdom by the Open Banking Implementation Entity (OBIE). The OBIE was established by the CMA and is funded by the CMA9. The CMA’s UK Retail Banking Market Investigation Order 2017 (Order), which applies only to the CMA9, requires the CMA9 to provide their customers with the ability to access and share their account data on an ongoing basis with TPPs through the use of specified application programme interfaces (APIs). This compliments the reforms under the EU’s Second Payment Directive (as transposed in the United Kingdom primarily by the Payment Services Regulations 2017), which requires all payment account providers to permit open access to payment accounts for authorized TPPs, but which does not specify the means of access or prescribe the scope of access in any detail.
The Clearing House (the oldest banking association and payments company in the United States) recently released a model agreement as a voluntary starting point to facilitate data sharing between financial institutions and fintech companies.
The model agreement is intended to provide a standardized foundation that speeds up data access agreement negotiations; as the Clearing House notes, “[L]egal agreements between banks and fintechs have sometimes taken 12 months or more to be developed and finalized and have become a significant bottleneck to API adoption.” Additionally, the model agreement is designed to reflect the Consumer Financial Protection Bureau’s consumer protection principles on data sharing and aggregation, providing confidence to the contracting parties that the terms address key regulatory issues.
The EU Commission issued its report on the third annual review of the functioning of the EU-US Privacy Shield (Privacy Shield) on October 23. The annual review and corresponding report is required of the Commission by the its July 2016 adequacy decision in which it found that the Privacy Shield ensures an adequate level of protection for personal data that has been transferred from the European Union (EU) to the United States. The goal of the review is to evaluate and publicly report on all aspects of the functioning of the Privacy Shield Framework.
The Outsourcing Accountability Act of 2019, which was introduced in July and would effectively require some public companies to report their outsourcing of jobs, passed the US House of Peoples Representatives on October 18.
The bill includes an amendment to the Securities Exchange Act of 1934 to “require the disclosure of the total number of domestic and foreign employees of certain public companies.” Specifically, the amendment would require public companies that are subject to the new requirements to include in their annual reports the number of employees domiciled in the United States and abroad, broken down by jurisdiction (e.g. states, countries, etc.), and a comparison to the corresponding figures in the company’s prior annual report calculated as a percentage change. The companies’ annual reports would therefore indicate outsourcing efforts of the company through these reported figures.
Morgan Lewis partners Ksenia Andreeva, Anastasia Dergacheva, Vasilisa Strizh, and Brian Zimbler and associate Anastasia Kiseleva contributed the chapter on Russia for the recently released Data Protection & Privacy 2020, the eighth edition of the Lexology Getting the Deal Through publication.
Lexology Getting The Deal Through provides international expert analysis in key areas of law, practice, and regulation for corporate counsel, cross-border legal practitioners, and company directors and officers. The publication addresses many of the most important data protection and data privacy laws in force or in preparation throughout the globe, with a discussion of the same key data protection and privacy questions with analysis from leading practitioners in each of the featured jurisdictions.
California has become the first state to allow collegiate student athletes to benefit financially from the use of their name and likeness and to enter into licensing contracts by recently passing Senate Bill 206, a bill known nationally as the “Fair Pay to Play Act.” But, we recommend holding off on preparing templates for student athlete license and promotional agreements for now; the legislation will undoubtedly face zealous resistance from the National Collegiate Athletic Association (NCAA) in the time before the law takes effect.
On September 30 the California Senate enacted Senate Bill 206, which would effectively end amateurism for NCAA athletes and therefore is a game changer for the NCAA, which currently prohibits college athletes from receiving compensation. The California law does not require colleges to pay athletes a wage, but it allows athletes to procure business and sponsorship deals.
As our loyal Tech & Sourcing readers know, we have been doing our best to keep you informed about the requirements of the California Consumer Privacy Act (CCPA) and what you can do to prepare as its January 1, 2020, effective date draws near. Continuing that vein, we invite you to an upcoming webinar wherein Morgan Lewis partners Reese Hirsch, Mark Krotoski, and Carla Oakley and associate Kristin Hadgis will provide an overview of the latest amendments to the CCPA, the state of the law and related regulations, and practical perspectives on CCPA compliance.
The Morgan Lewis team will discuss the following topics:
- The new one-year exemption for employee data*
- The new one-year exemption for B2B communications*
- Other new amendments, including those related to the use of toll-free numbers and verifiable consumer requests*
- Failed amendments and other issues to watch
- Status of California attorney general regulations and a possible new ballot initiative
- Other state laws influenced by the CCPA
- Preparing for the January 1 effective date and 2020 enforcement date
We hope you will join us for the one-hour webinar on Tuesday, October 22 at 1:00 pm ET.
*Indicates an amendment to the CCPA that has passed the California Legislature but, as of this writing, has not yet been signed into law by Governor Gavin Newsom.
Companies that use app-based technology platforms to connect consumers directly with service providers have faced an important question of whether the individuals providing the services are contractors or employees. California recently passed legislation that requires companies to treat contract workers that perform core company functions as employees.
The California legislature passed five bills on September 13 to amend and clarify the scope of the California Consumer Privacy Act (CCPA). If the amendments are signed by the California governor by the October 13 deadline, they will become part of the CCPA, set to take effect on January 1, 2020. A LawFlash by Morgan Lewis partner Reese Hirsch and associates Kristin Hadgis, Lauren Groebe, and Terese Schireson discusses the key proposals in each amendment, such as: