The Business Counselor Blog™

Electronic Mail Policies

This week I'm passing along an example of an electronic mail policy.  These policies govern the use of electronic mail (e-mail) service provided by companies to their employees.  It is essential for a company to have a clear e-mail policy that defines proper use and misuse of corporate e-mail services and informs all employees about their legal responsibilities with respect to sending and retaining e-mail messages.

Website Sponsorship Agreements

A company launching a website to serve the needs of a specific set of customers may wish to offer sponsorship opportunities to other businesses that would like to promote complimentary products and services that would be of interest to the target market.   For example, a website that is aimed at providing services to entrepreneurs might be of interest to an accounting firm that would like to have high visibility on the site.  The arrangement between the parties in this cases takes the form of a sponsorship agreement.        

Compliance Checklist for Privacy & Data Security Laws

In devising procedures for compliance with applicable privacy- and data security-related laws and regulations, the following transaction checklist may be helpful:

1. Determine the scope of the laws and regulations applicable to the company, including whether the business activities of the company require collection of information from consumers and/or fall within specialized regulated areas such as financial services or health care;
2. Review the steps that should be followed in order to develop a privacy and data security compliance program;
3. Designate a chief privacy officer and invest sufficient resources to staff a privacy compliance unit and procure the necessary technology to implement an effective privacy and data security program;
4. Consult applicable laws and regulations to develop a definition of the nonpublic personal information that must be covered by the company’s privacy and data security compliance program;
5. Conduct an assessment of the information previously collected by the company and the current and projected collection activities of the company to create an inventory of where nonpublic personal information is collected, used, stored and transferred;
6. Prepare and implement privacy-related policies and procedures, including general privacy policies and notices and procedures for collection and use of nonpublic personal information;
7. Establish training programs on privacy-related compliance issues for employees, contractors and other agents of the company;
8. Prepare and implement security requirements for nonpublic personal information, including information security policies and procedures;
9. Prepare procedures and contractual documents with respect to handling of the company’s nonpublic personal information by business partners and outside service providers;
10. Prepare and implement procedures for proper and effective disposal of nonpublic personal information that is no longer needed by the company to conduct its business activities;
11. Establish procedures for investigation and notification of security breaches; and
12. Establish and follow procedures for regular audits of the effectiveness of the company’s privacy and data security compliance program.

The content in this post has been adapted from material that appears in Business Transactions Solutions and is presented with permission of Thomson/West.  Copyright 2008 Thomson/West.  For more information or to order call 1-800-762-5272.

Privacy Policies and Notices

Every business, regardless of its size or line of business, should prepare, adopt, disseminate and follow appropriate policies and procedures with respect to protecting the privacy rights of its customers, employees and business partners.  One of the cornerstones of the privacy program is a comprehensive privacy policy or notice that is made available to customers and other parties from whom nonpublic personal information may be collected.  At a minimum a comprehensive policy or notice should include the following:

• An explanation of the reasons that the company collects personal information from its customers and other parties;
• A description of the specific types of personal information that the company regularly collects from its customers and other parties including examples of activities and transactions that will typically include information collection;
• A description of how the personal information collected by the company may be used in the company’s day-to-day activities and in the course of providing products and services to its customers;
• When applicable, a discussion of how personal information is collected and used when customers purchase gift cards and use other online services;
• A statement that information that visitors to the company’s web site voluntarily disclose in a public fashion is public and not subject to the protection obligations assumed by the company;
• A description of when and how the company discloses personal information and the steps that must be taken by customers and other parties to restrict such disclosures;
• A description of the measures taken by the company to protect personal information collected from customers and other parties;
• A description of the procedures which customers and other parties can follow to access their personal information to verify the accuracy of such information;
• A statement regarding the suitability of website content for children and other information required by federal and state laws regulating online marketing of products and services to minors;
• Instructions regarding how answers can be obtained to any further questions a customer or other party might have regarding the company’s privacy policy.

Statutes and related regulations play a significant role in the form and content of privacy policies and procedures and organizations must be mindful of the industry-specific requirements to which they may be subject.  For example, financial institutions publish their privacy principles in the form of a privacy notice that must be delivered to consumers that have a sufficient level of business contact with the institution.  The form of the privacy notice for a financial institution is determined in large part by the requirements of the federal Gramm-Leach-Bliley Act and financial institutions, such as a bank, will generally prepare a lengthy form of notice that includes additional information that may be of interest to consumers regarding the protection of the private information.  Health care providers and health plans should draft their privacy notices to conform to the requirements of the federal Health Insurance Portability and Accountability Act of 1996.

The content in this post has been adapted from material that will appear in Business Transactions Solutions (Fall 2008) and is presented with permission of Thomson/West.  Copyright 2008 Thomson/West.  For more information or to order call 1-800-762-5272.

Sponsorship Arrangements for Online Portals

Companies may be established to launch and maintain so-called “online portals” that focus on providing information and services to a targeted group of customers.  For example, a website might be created to appeal to entrepreneurs and provide information on how to start a new business, obtain financing, recruit employees and create a business plan.  In order to generate financial support for such a site and collect content of interest to the target group the promoters of the website may enter into sponsorship arrangements with professional services providers, such as a law or accounting firm.  The arrangement will be memorialized in a sponsorship agreement that sets forth the terms and conditions upon which the provider will be acknowledged as a “sponsor” of the portal, which will allow the provider to receive the benefits of having its name and services prominently featured in the portal in order to generate sales activities with the visitors to the site from the target market.  The agreement should describe the consideration to be delivered by the provider in order to maintain sponsorship status, the steps that the company is required to take in order to market and promote the services of the provider, the term of the agreement, and the terms of any licenses from the provider to the company relating to the use of the provider’s intellectual property (e.g., copyrighted materials and trademarks). The content in this post has been adapted from material that will appear in Business Transactions Solutions (Fall 2008) and is presented with permission of Thomson/West.  Copyright 2008 Thomson/West.  For more information or to order call 1-800-762-5272.

Domain Name Registration

An important step for any new business is obtaining a domain name that will serve as the online address for the company and a destination for customers and other business partners seeking information about the company.  Responsibility for assignment of IP addresses, registration of associated domain names, creation and management of Top-Level domain name systems (TLDs) and general oversight of the operation of the Internet domain name server system has been vested in the Internet Corporation for Assigned Names and Numbers ("ICANN"). ICANN is an internationally organized, non-profit corporation dedicated to preserving the operational stability of the Internet; to promoting competition; to achieving broad representation of global Internet communities; and to developing policy appropriate to its mission through bottom-up, consensus-based processes. Among other things, ICANN is responsible for accrediting registrars of domain names. In addition, ICANN takes the lead in creation of new TLDs.

There are several types of TLDs.  TLDs with two letters (e.g., .ca, .jp, and .mx) have been established for almost every country and external territory around the world and are referred to as "country-code" TLDs.  Each country-code TLD has its own manager who is responsible for operating the domain in a way that takes into account the specific economic, cultural, linguistic, and legal factors in the particular geographic area.  Most of the TLDs that have three or more characters are referred to as "generic" TLDs (gTLDs).  Seven gTLDs (.com, .edu, .gov, .int, .mil, .net, and .org) were created in the 1980s—three of them (.com, .net, and .org) were available for registration and use without restriction and the other four could only be used for limited purposes.  Seven new gTLDs (.biz, .info, .name, .pro, .aero, .coop, and .museum) were introduced in 2001 and 2002.  Three of these (.aero, .coop, and .museum) are sponsored top-level domains which are specialized an overseen by a sponsor that represents the narrower community that is most impact by the gTLD and is responsible for formulating operational policies for the gTLD.  The operational policies for unsponsored domains are set by the global Internet community acting through the processes established by ICANN.  ICANN continuously solicits and evaluates applications additional gTLDs and new gTLDs that have gone live during the last few years include .cat, .jobs, .mobi, and .travel.

In general, a domain name is comprised of a second-level domain, a "dot," and a TLD.  The wording to the left of the "dot" is the second-level domain, and the wording to the right of the "dot" is the TLD.  For example, if the domain name is "XYZ.COM," the term "XYZ" is a second-level domain and the term "COM" is a TLD.  The organization that is responsible for a particular TLD—the sponsor or registry operator—must establish and maintain a registry of the second-level domains within the TLD.  In general, domain names should be descriptive of the business they are associated with and easy to remember. Proposed domain names can be quickly checked for availability using various free online databases, such as www.whois.net.

Domain names may infringe the trademark or tradename of another business if there is a likelihood of confusion, mistake, or deception in the relevant market. To minimize the possibility of an infringement action, federal and state trademark searches should be performed for all potential domain names. Trademark Electronic Search System (Tess) is a service available on the Patent and Trademark Office's web site that provides a searchable database of trademarks. This free database provides a means for performing a fast, high level search for trademarks that may be the same as or similar to a client's prospective domain name. This service should not, however, be used as a substitute for a thorough trademark search performed by a professional trademark search company.

Once a domain name is chosen, the name should be registered, if possible, as a trademark or service mark with the United States Patent and Trademark Office ("PTO"). Domain names may be registered with the PTO provided they are actually in use as trademarks or service marks, and not merely as addresses. In September 1999, the PTO issued guidelines to its trademark examiners for the evaluation of applications to register domain names. Examination Guide No. 2-99 is available on the PTO's Website at www.uspto.gov/web/offices/tac/notices/guide299.htm. Because clients may be conducting business internationally through their Websites, registration of the domain names in foreign jurisdictions should also be considered.

The content in this post has been adapted from material that will appear in California Transactions Forms: Business Transactions (Fall 2008) and is presented with permission of Thomson/West.  Copyright 2008 Thomson/West.  For more information or to order call 1-800-762-5272.

Procedures for Responding to Data Security Breaches

In addition to a data security policy, each company should also have formal procedures in place to describe the steps that it is required to follow in the event of a security breach that results in the unauthorized disclosure of confidential personal information that the company is maintaining in its electronic and paper-based data systems.  The process should be triggered by either actual evidence of a security breach (i.e., acquisition of confidential personal information by an unauthorized person) or the occurrence of events that create a reasonable belief in the minds of company officials that a security breach is likely to have taken place (e.g., suspicious loss or theft of a computer or device that contains unencrypted confidential personal information).  The first step after the problem is noticed should be controlling and containing the systems that appear to have been breached and launching a preliminary internal investigation to ascertain the scope of the breach.  The internal investigation should be conducted with the assistance of outside forensic investigators.  The company should also contact law enforcement agencies (i.e., the Federal Bureau of Investigation and state and local police departments) to notify them about the breach and honor the instructions of those agencies as to whether or not the company should go forward with notifying affected persons or wait until such time as notice would not impede any law enforcement investigation.  Assuming that the law enforcement agencies do not object, the company should than take the necessary steps to comply with applicable federal, state and local requirements to notice affected individuals about the unauthorized access to their confidential personal information.  The specific requirements regarding the contents and timing of the notice, including the need to notify credit reporting agencies, should be verified.  Finally, in the case of public companies that suffer a security breach, a report of the breach should be made in the company annual and quarterly filings with the SEC (i.e., Forms 10-K and 10-Q) and persons within the company who have notice of the breach should be barred from trading securities of the company until a public announcement of the breach has been made and disseminated in the financial markets.