Numerous fintech companies (i.e., those entities that (1) have nontraditional or limited business models, (2) do not take deposits, (3) are not insured by the Federal Deposit Insurance Corporation (FDIC), and (4) rely on funding sources different from those relied on by insured banks) are currently debating whether they want to go through the rigmarole of becoming a special purpose national bank (SPNB). Becoming a SPNB is an extraordinary undertaking, and on July 31, 2018, the Office of the Comptroller of the Currency (OCC) released its Supplement to the Comptroller’s Licensing Manual (the Supplement), which describes the key factors the OCC will consider in evaluating charter applications to become a SPNB.

Set forth below is a punch list of key points of which any fintech company should be cognizant prior to launching into the SPNB application process.

The OCC strongly encourages potential applicants to engage with the OCC well in advance of filing a charter application, and such potential applicant should contact the Office of Innovation. In fact, the OCC Licensing Department actually will determine whether an entity should even submit a draft application before filing a formal application.

In determining whether to file a formal application to become a SPNB, perhaps the most important factor for any fintech company to always bear in mind is that as a national bank (i.e., a SPNB), they will be subject to the laws, rules, regulations, and federal supervision that apply to all national banks. As such, the filing procedures for an SPNB will be substantially the same as those of any other national bank, including being made available for public comment.[1] Moreover, companies seeking a charter as an SPNB will be expected to (1) make a commitment to financial inclusion, and (2) develop and adhere to a contingency plan that includes options to sell, wind down, or merge with a nonbank affiliate, if necessary.

If a fintech company files a charter application, the OCC will consider the applicants (1) business model, (2) governance structure, and (3) risk profile.[2] In addition, potential applicants should be prepared to discuss: (1) its proposed activities, (2) the market analysis supporting its business plan, (3) its capital and liquidity needs, (4) its contingency plan for periods of financing stress, and (5) how it will demonstrate a commitment to financial inclusion.

Once an application is filed, the OCC seeks to make a decision on a complete and accurate application within 120 days after receipt. The OCC grants approval of a charter application in two steps: (1) preliminary conditional approval and (2) final approval. The OCC will issue a final approval once it determines all key phases of organizing the bank have been completed, all requirements and conditions for final approval have been met, and the organizers have received any other necessary regulatory approvals. The OCC will also impose assessments on a SPNB as a condition of approval. After final approval, the OCC will supervise the SPNB as it does all other national banks, and like all de novo institutions, newly chartered SPNBs will be subject to rigorous ongoing oversight to ensure that the bank’s management and board of directors are properly executing their business strategy, and the bank is meeting its performance goals.[3]

Although becoming a SPNB is indeed an extraordinary undertaking, for many it may be worth the effort, and there are law firms that can assist every step of the way.

[1] For details on filing an application, see 12 C.F.R. § 5 and the “Charters” booklet of the Comptroller’s Licensing Manual.

[2] For details on the review of applications, see 12 C.F.R. § 5 and the “Charters” booklet of the Comptroller’s Licensing Manual.

[3] Key supervisory considerations for SPNBs are highlighted in Appendix A to the Supplement.

On January 28, 2019, the Panoptykon Foundation filed a complaint with the Polish Data Protection Authority against IAB Europe on behalf of an individual, alleging that OpenRTB, the widely-used real-time bidding (“RTB”) protocol promulgated by IAB Tech Lab,[1] violates numerous provisions of the General Data Protection Regulation (the “GDPR”). The complaint recycles many of the same arguments made to the Irish Data Protection Commission and the UK Information Commissioner’s Office in 2018; we analyzed these other arguments in a previous article.

The complaint argues that IAB should be considered a data “controller” under the GDPR for all processing activities undertaken through OpenRTB.  As discussed below, such a contention would dramatically (and improperly) expand the definition of “controller” and should be rejected by regulatory authorities.

Controller Framework

The GDPR regulates “processing activities” (i.e., discrete operations performed on personal data).  An entity is either a data “controller” or a data “processor” with respect to such processing activities. In other words, the determination of an entity as controller or processor must be analyzed in relation to whatever processing activities are in question.

All processing activities have at least one controller. A controller determines the “purposes” and “means” of such processing activities, either alone or jointly with other controllers.  The “purpose” is why a processing activity is being carried out and the “means” are how that processing activity will be carried out.

Although the definition of “controller” has been interpreted broadly, guidance and case law require that an entity, alone or with others, have a certain level of factual “influence” on the purpose and means of processing to be considered to have “control.” Indeed, the Article 29 Working Party (the “WP”) provides that “[b]eing a controller is primarily the consequence of the factual circumstance that an entity has chosen to process personal data for its own purposes.” (Emphasis added). 

The WP further explains that determination of the means “would imply control when the determination concerns the essential elements of the means.” (Emphasis added).

Determination of the “means” therefore includes both technical and organizational questions where the decision can be well delegated to processors (as e.g. “which hardware or software shall be used?”) and essential elements which are traditionally and inherently reserved to the determination of the controller, such as “which data shall be processed?”, “for how long shall they be processed?”, “who shall have access to them?”, and so on. (Emphasis added).

Thus, although determining the purpose of a processing activity automatically renders an entity a “controller,” an entity determining the means of processing is considered a controller only when such determination concerns the essential means.

The Jehovah’s Witnesses Case

The complaint relies primarily on one case from the European Court of Justice (“ECJ”) to support its claim that IAB is a controller with respect to all processing activities undertaken through OpenRTB: Case C-25/17 (the “Jehovah’s Witnesses case”). The complaint also cites to Case C-210/16, which we discuss and distinguish in our previous article linked above.

In the Jehovah’s Witnesses case, Jehovah’s Witnesses members (i.e., preachers) went door-to-door to convert others to their faith.  The members wrote notes on their visits, such as the names of the people they visited, their addresses, and summaries of their conversations.  The Data Protection Supervisor claimed that the Jehovah’s Witnesses religious community (the “JWC”) was a controller in relation to the notes taken by their members during this door-to-door preaching.

The JWC contended that it was not a data controller because it did not determine the purposes and means of processing, alleging (1) the JWC did not formally require the collection of notes by its members and (2) the JWC did not have access to the members’ notes. 

The ECJ, along with the Advocate General, analyzed the JWC’s potential role as a data controller in relation to the specific processing activity in question: members’ note taking when door-to-door preaching. The ECJ held that the JWC “organized and coordinated” the preaching to such a level that it defined the purposes and means of processing in the context of that preaching jointly with its members.  The Advocate General emphasized that the JWC: (1) “gave very specific instructions for taking notes;” (2) allocated areas among the members to better organize the preaching and increase the chances of converting individuals; (3) kept records on how many publications the members disseminated and the amount of time they spent preaching; and (4) kept a register of individuals who did not want to be visited.

Analysis of the Complaint

First, the complaint alleges that “IAB is one of the two leading actors…in the market of behavioural advertising which organises, coordinates and develops the market by creating specifications of an API…that is utilised by companies that participate in [OpenRTB] auctions in ad markets…Those specifications are accompanied by the rules of their application [in the IAB Transparency and Consent Framework].[2]”

The complaint does not claim that IAB is the controller of any specific processing activities. Instead, it claims that IAB is the controller of all processing activities undertaken through OpenRTB that relate to “behavioural advertising” because it is a “leading actor” that “organizes, develops and coordinates the market.” In other words, it is stating that IAB’s control over the market is similar to the JWC’s control over its preachers in that the IAB co-determines what personal data shall be processed and why for all participants within OpenRTB and, by extension, the multi-billion dollar behavioral advertising industry.

The complaint’s reliance on the “organized and coordinated” language within the Jehovah’s Witnesses case ignores all context in which it was used. “Organization and coordination” was only relevant because it resulted in determination of the purpose and means of processing within that particular fact pattern. In other words, the JWC’s “organization and coordination” of the members’ note-taking activity amounted to such tight control that it was viewed as instructing them to process personal data on its behalf for a discrete purpose and, thus, determining the “purpose and means of processing” as a joint controller.

However, the level of control in the Jehovah’s Witnesses case is readily distinguishable. The JWC instructed its members (i.e., its preachers) to go door-to-door for the discrete purpose of expanding the JWC’s membership (i.e., converting others to its faith). To ensure the effectiveness of the activity, the JWC “organized and coordinated” the activity by assigning members to different areas, keeping track of how long they preached and how many publications they distributed, and providing detailed instructions on what notes to take (i.e., what personal data to process).

Conversely, IAB’s promulgation of the OpenRTB standard does not result in the IAB instructing or direction another business as to what personal data it shall in fact process or transfer through the protocol, or for which purposes. Unlike preachers answering to a centralized authority, entities do not engage in processing activities over OpenRTB at the behest of, or for a shared purpose with, IAB.

A standard’s primary objective is to define technical requirements for interoperability among various systems. As such, it allows entities to carry out activities more efficiently through a common “language.” However, this development of a communication medium by which processing activities may be carried out must be differentiated from the processing activities themselves. The purpose for initiating processing and each subsequent operation relating thereto (e.g., collection, transmission to downstream partners) is determined at the business level. IAB’s defining of the protocol’s structure provides the technological capability for entities to carry out such activities, but it is not, in itself, a processing activity or “purpose.” The alternative would create a virtually unlimited definition of “controller.”  Likewise, IAB’s theoretical ability to lessen the processing capability of the protocol – such as eliminating the “device identifier” field – also cannot be a criterion by which control is decided in this context. If such ability were acted upon, it would only limit the range of processing activities capable within that technology (activities that organizations need not carry out in the first place). This attenuated “control by exclusion” leads to bizarre results and is not what the GDPR intended. For example, any provider that releases technology capable of a range of processing activities would become a controller of all such activities if it ever puts limits on that capability.

Second, the complaint also alleges that “IAB has full control of how the behavioural advertising market within…[OpenRTB] is designed and operates, so it decides at its own discretion how the processing of personal data is to be carried out, e.g., by determining the elements that must be included in the so-called bid request, i.e., a request for submission of bids in an ad market.”  In other words, the complaint argues that IAB, through OpenRTB, decides the essential means of all processing activities carried out under the technical protocol.  

When analyzed against the aforementioned elements highlighted by the WP, IAB does not determine the “essential means” of the processing activities carried out over OpenRTB:

• Which data shall be processed?
  • IAB does not decide what data will be processed when entities carry out processing activities via OpenRTB. The complaint conflates the capability to allow entities to process personal data with deciding what data shall be processed for any given processing activity.
  • The Panoptykon Foundation and related parties argue that because almost all bid requests sent via OpenRTB contain at least a device identifier, and OpenRTB documentation recommends device identifiers be included in bid requests, IAB decides that entities shall process device identifiers. Such an argument is unavailing. Technology providers routinely recommend that personal data be processed for added business value (e.g., SaaS platforms). No one has seriously argued that these providers automatically become joint controllers by virtue of doing so. The decision to process such data is left to the autonomy of the user.
• For how long shall the data be processed/when should the data be deleted?
  • IAB does not mandate retention periods. Such a decision is solely within the business’s own legal judgment for what satisfies the storage limitation principle for its particular processing activities.
• Who shall have access to the data?
  • This decision is, again, controlled entirely by the entities using OpenRTB and differs dramatically depending on the context in which advertising may be transacted (e.g., open auction, private marketplace, programmatic, or direct).

Third, according to the complaint, IAB is a controller because it has general knowledge that processing is happening through OpenRTB:

[T]he JWC, which collects information on its members (as opposed to information on persons visited by its members), becomes, by creating guidelines and maps, a joint controller of personal data of persons visited by its members despite the fact that it does not establish any direct interaction with those persons and has no access to such data. This instance can be directly compared with IAB, as its role is also to provide guidelines and specifications to companies that participate in auctions in ad markets. Like the community analysed by the CJEU, IAB has a general knowledge of the fact that processing is carried out and knows its purposes (matching ads in RTB model), as well as it organizes and coordinates activities of its members by way of management of… [OpenRTB].

Although it is correct that an entity does not need direct access to data to be a controller, it still needs a level of control sufficient to determine the purposes and means of processing.  Much of the above quote is a restatement of the complaint’s previous arguments examined herein.

However, there is one slightly different argument presented: “IAB has a general knowledge of the fact that processing is carried out and knows its purposes…” and thus is a controller. This “general knowledge” standard that the complaint proposes further ignores all context and nuance from the Jehovah’s Witnesses case. Clearly, every company that has a general knowledge that processing is being carried out through its technology, and is aware of the purpose for which its carried out, cannot be a joint controller or else virtually every technology company (e.g., standards bodies, SaaS platforms, and software companies) would be a joint controller.

The CJEU’s mention that the JWC was aware of its members’ processing of personal data (i.e., note taking) was to demonstrate that excessive formalism (i.e., an express written statement telling individuals to process data) should not be required when an entity has such a level of control that it, practically speaking, instructs others to carry out processing of personal data for a defined purpose. As mentioned above, providing guidelines and technical specifications to companies, or simply knowing that personal data is being processed through OpenRTB, does not amount to the level of control contemplated by the GDPR or prior case law to become a joint controller.  

Finally, the complaint contends: “The argument that [OpenRTB] created by IAB is only a technical protocol which does not obligate particular companies to process data is ill-advised and not true. [OpenRTB] enables and facilitates the processing and dissemination of data as the protocols that are connected with [Open RTB] include certain fields that are so designed that they trigger transfers of data, including sensitive data….”

Notwithstanding such allegations, OpenRTB does not obligate companies to process personal data. None of the required fields to send a bid request per OpenRTB documentation contain personal data. Fields at issue in the complaint, such as the description of a URL’s content, geolocation, device identifier, and user agent string, are optional. This optionality makes sense because OpenRTB is used for activities outside of “behavioral advertising,” such as digital out-of-home and contextual advertising, and in such cases personal data is often irrelevant or not processed.

As mentioned above, the complaint conflates providing entities the capability to process personal data, or recommendations to process personal data (e.g., bid request examples and recommended fields within OpenRTB documentation) for added business value, with having the requisite control to decide what data shall be processed by a particular entity.  

Conclusion  

It seems evident that behavioral advertising critics desire IAB to amend OpenRTB so that no personal data is capable of being transmitted at all. In their singular focus to bring about this result, these parties advocate expanding the definition of controller so broadly as to render almost all companies in every industry as controllers.

If they succeed, although they may accomplish their own goals, they may also stop (or diminish) the willingness of technology providers and standards bodies to engage in the European market.  Here, we should heed the Advocate General’s warning in the FashionID opinion that excessively expanding the scope of what constitutes a controller will create such a lack of clarity that it “…crosses into the realm of actual impossibility for a potential joint controller to comply with valid legislation.”

[1] The Complaint is filed against IAB Europe; however, IAB Tech Lab, rather than IAB Europe, promulgates the OpenRTB standard. For convenience, we use the term “IAB” throughout this article.

[2] All quotes taken from the complaint have been translated from their original Polish.

In recent years, the OCC has aggressively used its cease and desist authority to address a variety of supervisory problems, including unfair or deceptive acts or practices, Bank Secrecy Act/anti-money laundering, and safety and soundness. As a result, there are a sizeable number of consent cease and desist orders that are in place against OCC-supervised institutions. Although the OCC has issued consent orders against banks of all sizes, the largest institutions have been disproportionately affected, and many of them remain under longstanding consent orders.

Unfortunately, the issuance of a consent order does not necessarily resolve a bank’s supervisory issues with the OCC. In a series of high-profile cases last year, the OCC assessed civil money penalties against banks that were already subject to consent orders of various durations. Civil money penalties (CMPs) levied against five major banks in 2018 approached $800 million. All of these actions are for compliance breakdowns, and most of them involve deficiencies with respect to BSA/AML compliance, which continues to be a perennial issue. The size of these penalties alone demonstrates that the OCC will act forcefully to ensure that timely corrective action is taken, and that compliance with existing consent orders will be vigorously enforced.

The assessment of a CMP following the issuance of a consent order is not unusual. In fact, it has long been a common practice for the OCC, especially in BSA/AML cases, to bifurcate its decision with respect to a penalty assessment from the remedial consent order. There can be various reasons for this, but two common reasons are to allow the OCC’s CMP process to be informed by the bank’s record of compliance with the consent order and the results of any “lookback” reviews, and to coordinate the OCC’s penalty action with any other agencies that are taking a concurrent action.

Action Plans

Consent orders typically require banks to develop a number of action plans to remedy the violation or unsafe or unsound practice that gave rise to the order. Although prepared by the bank, the action plans must be submitted to the agency for a determination of supervisory nonobjection. The plans should contain detailed action items that serve as a roadmap for bringing the bank back into compliance with the applicable legal and regulatory requirements. The OCC expects such plans to include specific deadlines for completion of each action item, and those deadlines effectively become the applicable deadlines under the consent order. Thus, a failure to achieve timely compliance with the action items in the plan will cause the bank to be deemed in noncompliance with the consent order itself. This is significant because not only is a violation of a consent order a basis for a CMP assessment in and of itself, but it starts the clock running for determining the number of applicable violation days for purposes of calculating the maximum penalty the agency can assess.

Consequently, banks must carefully consider the elements of their action plan and set realistic deadlines for completion of each action item. Banks that are subject to consent orders must have not only a project team in place that can execute the action plan, but governance over the entire process to ensure that it stays on track. Although the bank can request the extension of a deadline, such requests must be well supported and are not freely granted.

Although action plans can be amended if new problems are identified, this can result in the consent order remaining in place for an extensive period of time, especially if new violations or deficiencies are cited at subsequent examinations. In general, the longer a consent order is in place without the bank achieving compliance with all of its articles, the greater the chances that the agency will assess a CMP, in addition to the bank being subject to the restrictions and consequences of the consent order for a longer period of time.

Conclusion

The OCC’s 2018 CMP cases underscore the possibility that the agency may assess a CMP even after the bank stipulates to issuance of a consent order, and the likelihood of a CMP assessment is greater if the bank is deemed in noncompliance with the order. In order to mitigate the likelihood of a CMP, it is imperative that banks subject to a consent order make development of a remedial action plan a top priority, establish effective governance mechanisms to oversee implementation, and dedicate staff and resources to execute the plan and achieve compliance in a timely fashion.

There is slow-moving, high drama happening in Colorado between the Federal Deposit Insurance Corporation (FDIC) and the administrator of the Colorado Uniform Consumer Credit Code (UCCC). This refers, of course, to the litigation filed by the Colorado UCCC administrator against Avant and related parties, and Marlette Funding and related parties (the Partners) (Zavislan v. Avant of Colorado LLC, 2017cv30377 (District Court City & County of Denver, Mar. 9, 2017); Meade v. Marlette Funding LLC d/b/a Best Egg, 2017cv30376 (District Court City & County of Denver, Mar. 3, 2017)). This drama intensified last fall when the regulator amended its complaint, originally filed in March 2017, to add national bank defendants. In these cases, the national bank defendants—Wilmington Trust, N.A. and Wilmington Savings Fund Society, FSB—act as the trustee for trusts established to hold bank-originated loans or receivables that are sold by the banks after origination.

At the heart of the litigation is who the “true lender” is on the loans made by the banks. The Partners assert that the banks involved in the partnership are, in fact, the lender. Conversely, the Colorado administrator asserts that the alleged partnership is a mere sham—a way for nonbanks to avoid state laws by taking advantage of the powers of banks to export interest and interest fees from their home states or states where they have a branch. This power, or “rate exportation,” is extended to banks because banks are given special treatment under federal and state law. It takes more to become a bank than to simply be a licensed lender. Banks are subject to rigorous oversight not only by their state regulator if said bank is state-chartered, but also by a federal regulator, such as the FDIC, which it turns out has spent a great deal of time thinking about how its member banks work with the Partners. Additionally, state regulators, some more than others, despise that rate exportation exists because states would prefer to exercise control over all depository entities, sometimes asserting consumer protection as the ostensible basis for their desire to control the banks.

Although the FDIC is not named as a defendant in the Colorado litigation, the Colorado UCCC administrator is taking direct aim at the banking agency’s guidance to its member banks who engaged in the partnership space. The FDIC has discussed third-party involvement with its member banks in numerous publications, including the Winter 2015 issue of Supervisory Insights in which it offers guidance to participants in the bank partnership space. The FDIC notes that some marketplace lending companies operate though a cooperative arrangement with a partner bank. The FDIC describes the arrangement thusly:

In these cases, the bank-affiliated marketplace company collects borrower applications, assigns the credit grade, and solicits investor interest. However, from that point the bank-affiliated marketplace company refers the completed loan applications to the partner bank that makes the loan to the borrower. The partner bank typically holds the loan on its books for 2–3 days before selling it to the bank-affiliated marketplace company.

In July 2016, the FDIC went beyond the discussion in Supervisory Insights and issued proposed guidance for its member banks that work with the Partners to originate loans, including vendors involved in bank partnerships, supplementing the many financial institution letters the FDIC has issued on this topic. The FDIC requested comments on its proposed guidance that outlines the risks that may be associated with third-party lending, as well as the expectations for a risk-management program, supervisory considerations, and examination procedures related to third-party lending. The proposed guidance, which has never been finalized, describes third-party lending as an arrangement in which a bank relies on an outside source to perform a significant aspect of the lending process, such as originating loans for third parties, originating loans through third parties or jointly with third parties, and originating loans using platforms developed by third parties. The draft guidance supplements and expands on previously issued guidance and would apply to all FDIC-supervised institutions that engage in third-party lending programs.

In its publications on this topic, the FDIC has walked through factors a bank should examine before entering into a partnership with a nonbank entity. It directs its member banks to consider the partner’s compliance with applicable federal law, consumer protection requirements, anti-money laundering rules, and fair-credit obligations, as well as applicable state laws such as licensing or registrations necessary to engage in the partnership. The FDIC also asks its member banks to consider whether the partnership will meet the FDIC’s safety and soundness requirements. Specifically, member banks should consider the following questions:

• What duties does the bank rely on the marketplace lending company to perform?
• What are the direct and indirect costs associated with the program?
• Is the bank exposed to possible loss, and are there any protections provided to the bank by the marketplace lending company?
• What are the bank’s rights to deny credit or limit loan sales to the marketplace lending company?
• How long will the bank hold the loan before sale?
• Who bears primary responsibility for consumer compliance requirements, and how are efforts coordinated?
• Is all appropriate and required product-related information effectively and accurately communicated to consumers?
• What procedures are in place to prevent identity theft and satisfy other customer identification requirements?
• What other risks is the bank exposed to through the marketplace arrangement?

In its complaints against Avant and Marlette Funding, the administrator trots out several facts as allegedly indicating that the bank is not the true lender in the partnership. Some questions fintech companies and their partner banks may ask themselves in light of the Colorado litigation include the following:

• Did the partner pay an implementation fee? What was the amount of the implementation fee?
• Does the partner pay the bank’s legal fees and expenses related to the partnership? Does the partner pay the expenses and legal fees that the bank incurs to negotiate the partnership? Does the partner pay the bank’s legal fees when the bank is sued over the partnership?
• Does the partner bear all the expenses incurred in marketing the loans?
• Does the partner pay all the costs of determining which loan applicants will obtain loans, including paying employees to evaluate loan applications, purchasing credit reports, and paying wire transfer and ACH costs for money transfers in connection with the loans?
• Does the partner decide which applicants get loans, applying lending criteria agreed to by the partner and the bank?
• Did the partner or the bank develop and implement the processes used by the partner to identify qualifying loan applicants?
• Is the partner responsible for ensuring that the partnership complies with all applicable federal and state laws?
• Who developed and implemented policies for the partnership, which were used to ensure compliance with laws such as the Bank Secrecy Act, the Truth in Lending Act, and others?
• Who is responsible for all communications with loan applicants and borrowers, including providing adverse action notices or loan agreements?
• Who is responsible for all servicing and administration of the loans, even before the bank sells the loans to the partner?
• Who has the right to consumer information? If an applicant is denied credit, can the partner solicit the consumer for other credit products? Is the bank permitted to use the information from applicants or borrowers? If so, how?
• Who bears the risk of loss of principal if a borrower defaults?
• Is there a collateral account? Does it secure the purchase of the loans by the partner? Where is the collateral account held? How much money must be in the account?
• What does the purchase price for the loans include? Does it only include the amount advanced to the borrower, or does it include other amounts?
• How are the loans sold? With or without recourse?
• Does the partner indemnify the bank from and against claims arising from the partnership?
• How are the loans funded? Does the partner fund the loans? Does it raise money from institutional investors to fund the loans?
• Who shares in the profit of a paid-off loan? What is the percentage of the distribution of profit?

The “rent-a-bank” or “true lender” theory advanced by the Colorado administrator does not derive from a statute or regulation. Rather, it derives from case law and brute disdain that rate exportation exists. The lawsuit represents a most serious affront to the power of banks to both export interest rates and to hire partners to help them do it. There is, in fact, no statute or regulation in Colorado that prohibits a bank from engaging the services of a partner to aid them in their lending activities.

Indeed, the FDIC noted in its Supervisory Insights that banks can manage the risks posed by potential partnerships through proper risk identification, appropriate risk-management practices, and effective oversight of the nonbank partner. Virtually all documents that memorialize partnerships will contemplate and address these questions and, importantly, the FDIC does not dictate what the answers should be; rather, the FDIC is concerned about the risks vendor relationships pose to its member banks that engage in third-party relationships as an exercise of their bank power.

As of this writing, there has yet to be any litigation that addresses the tension between the directives of the FDIC to its member banks and the concept of “true lender,” although the Colorado litigation certainly raises questions. The FDIC and its member banks should not shy away from this discussion, which raises significant public-policy issues over who gets to claim the mantle of consumer protection, and what consumer protection should look like. Many consumers in Colorado no doubt want loans originated by banks through partnerships because they are often both faster and less expensive than available alternatives. In addition, an argument can be made that a bank acts as a true lender when it exercises the authority granted to it by the FDIC, its primary federal regulator. In other words, a bank exercising its power to hire a partner does not magically stop being a bank by exercising this power. It is likely that as pressure continues to tighten on bank partnerships though litigation such as the Colorado lawsuits and legislative efforts to curtail bank powers, banks involved in such partnerships and their partners will assert their power to engage partners consistent with the FDIC’s guidance in response.

While considering the specific criminal charge of voyeurism, Canada’s Supreme Court of Canada recently confirmed that privacy is not an ”all-or-nothing concept,” and being in a public or semi-public space does not automatically negate all expectations of privacy with respect to observation or recording.

This case involved Mr. Ryan Jarvis, an English teacher at a high school who used a camera concealed inside a pen to make surreptitious video recordings of female students (particularly focusing on their faces, upper bodies and breasts) while they were engaged in ordinary school-related activities in common areas of the school. The students were unaware they were being recorded, and a school board policy in effect at the relevant time expressly prohibited the type of conduct engaged in by the accused. Mr. Jarvis was charged with voyeurism under s. 162(1)(c) of the Canadian Criminal Code (where a person surreptitiously observes or makes a visual recording of another person who is in circumstances that give rise to a reasonable expectation of privacy, if the observation or recording is done for a sexual purpose).

At trial, Mr. Jarvis admitted he had surreptitiously made the video recordings but the trial judge acquitted him because he was not satisfied the recordings were made for a sexual purpose. The Court of Appeal concluded that the trial judge had erred in law in failing to find that the accused made the recordings for a sexual purpose, but upheld the accused’s acquittal on the basis that the students were not in circumstances that give rise to a reasonable expectation of privacy since they were recorded in a “public” space (public areas of their high school which had security cameras recording them). 

The Supreme Court allowed the appeal (and entered the conviction) with the majority confirming that the students recorded by the accused were in circumstances that give rise to a reasonable expectation of privacy for the purposes of s. 162(1) of the Criminal Code. The Court found that “circumstances that give rise to a reasonable expectation of privacy” are circumstances in which a person would reasonably expect not to be the subject of the type of recording that had occurred, while considering the entire context in which the observation or recording took place. Significantly, the Court found that privacy is not an “all-or-nothing concept,” and whether an observation or recording would generally be regarded as an invasion of privacy depends on a variety of factors. The Court set out a non-exhaustive list of considerations, which include: (1) the location the person was in when she was observed or recorded, (2) the nature of the impugned conduct (whether it consisted of observation or recording), (3) awareness of or consent to potential observation or recording, (4) the manner in which the observation or recording was done, (5) the subject matter or content of the observation or recording, (6) any rules, regulations or policies that governed the observation or recording in question, (7) the relationship between the person who was observed or recorded and the person who did the observing or recording, (8) the purpose for which the observation or recording was done, and (9) the personal attributes of the person who was observed or recorded. 

Considering the overall context, the Court found that there can be no doubt that the students’ circumstances give rise to a reasonable expectation that they would not be recorded as they had been, especially considering that they were (i) teenage students at a high school; (ii) recorded by their teacher in breach of the relationship of trust; and (iii) in contravention of a formal school board policy that prohibited such recording. The Court confirmed that individuals “going about their day-to-day activities – whether attending school, going to work, taking public transit or engaging in leisure pursuits…reasonably expect not to be the subject of targeted recording focused on their intimate body parts (whether clothed or unclothed) without their consent.” In recording these videos, the accused acted contrary to the reasonable expectations of privacy that would be held by persons in the circumstances of the students when they were recorded.

Lisa R. Lifshitz

With the Illinois Supreme Court’s recent decision in Rosenbach v. Six Flags Entertainment Corp., the floodgates have opened for class actions in Illinois against businesses that collect biometric information from employees or customers. In Rosenbach, the Illinois Supreme Court ruled that alleged procedural violations of Illinois’s Biometric Information Privacy Act (“BIPA”) are enough, without alleging actual injury to an individual, to bring an action under the law. Although the details of that decision can be relevant to specific situations, —you need to know what to do now in light of this new ruling, particularly if your company currently is collecting biometric information from customers or employees, or considering doing so in the near future.

If your company has been collecting biometric data:

• Initiate a rapid internal audit to determine how your company, or any agent or contractor you hire, is using biometric data for any reason (e.g., security for facilities or devices, time clock or other employment verification, or marketing to consumers).
• Once you understand the scope of biometric data collection, implement BIPA’s requirements, which include: (1) informing an individual that his or her biometric information is being collected or stored; (2) informing the individual of the purpose of the collection, storage and/or its use, along with how long such information will be collected, stored, or used; and (3) receiving a written release from the individual to collect the information.

Since the Rosenbach ruling, we have seen a quick and significant increase in the number of BIPA class action lawsuits filed. If your company is currently facing a lawsuit over an alleged BIPA violation, consider taking the following steps: 

• Remove the case to federal court, if possible. Based on Supreme Court precedent and a recent decision from an Illinois federal court, defendants facing these class actions may be able to challenge a plaintiff’s standing to bring suit based solely on a procedural violation of the statute where no actual harm has occurred.

• Identify sources of either express or implied consent for the collection of biometric information. For example, employees may have received notice from an employee handbook about collection of their biometric data.  
• Assert class action defenses related to typicality and commonality. Typicality is meant to ensure that the named plaintiff’s claims have the same essential characteristics as the claims of the entire class. If proof of the named plaintiff’s claims would not necessarily prove all of the proposed class members’ claims, the plaintiff fails the typicality requirement.  Commonality requires plaintiffs to demonstrate that the class members have suffered the same injury, meaning that they were affected by the same violation of the same statute. This emphasis on dissimilarities between plaintiffs will illustrate whether there are any class-wide commonalities.

Finally, companies considering biometric data collection in Illinois should:

• Prepare explicit disclosures and documents for written consent as required by BIPA.
• Determine whether the collection of biometric data is truly necessary for the business, given the strict requirements of BIPA and increase in the number of lawsuits. If this data is necessary, collect as little as possible and consider whether it can be captured and not retained.
• Avoid collection of biometric data in Illinois. Some companies have begun altering their behavior in Illinois to adhere to the law. For example, Nest, a maker of smart thermostats and doorbells, sells a doorbell with a camera that can recognize visitors by their faces. However, Nest does not offer that feature in Illinois because of BIPA.
• Keep an eye on legislative developments. Many other states have considered biometric privacy legislation over the years, but only Texas (in 2009) and Washington (in 2017) have passed such laws. But that may change soon. In the first few weeks of 2019 alone, legislators have already introduced new bills in Arizona, Connecticut, New Hampshire, New Mexico, New York, Oregon, and Washington. These initiatives have the potential to introduce a conflicting national patchwork of regulations.
• In Illinois, there is currently a bill (SB3053) pending before the Illinois legislature to amend BIPA. The bill proposes to exempt private entities from BIPA’s requirements under a number of circumstances, including (1) if the biometric information is used “exclusively for employment, human resources, fraud prevention, or security purposes,” (2) if the company “does not sell, lease, trade or similarly profit” from the biometric information, or (3) if the company protects biometric information at least as securely as it secures other sensitive information.

This article is adapted from the recent Asia Ascending: Insider Strategies for Competing with the Global Colossus, published by the American Bar Association.

President Trump surprised many observers in August 2017 when he abruptly ordered the Office of the United States Trade Representative (USTR) to initiate an in-depth investigation into China and the need for protecting intellectual property (IP). The USTR confirmed that 40 million jobs in America were at risk because they were, either directly or indirectly, attributable to IP industries. The president utilized section 301 of the Trade Act of 1974 as the tool to target what he viewed as China’s unjustified actions harming certain U.S. industries. Interestingly, the president used section 301 in the same way it had been utilized two decades earlier to target Japanese trade practices.

Six months later, after it was announced that China’s 2017 trade deficit with the United States had exceeded $375 billion, the issue came to a very public boil. The trade deficit with China now dwarfs the size of the trade deficit with Japan during the 1990s. The Trump administration’s reaction to the trade deficit was to impose high tariffs on some Chinese goods with the threat of higher tariffs on a broader range of goods if significant changes were not implemented. As we all know, China retaliated.

Although unlikely to resolve quickly, I predict this high-profile clash—“trade war” may be too strong a label—will fizzle out over time. There are two key factors influencing the current trade dispute between the United States and China: economics and politics.

First, consider the economic factors. Although neither China nor the United States is willing to publicly admit it, both countries are so closely intertwined economically that neither can afford to engage in an all-out trade war without triggering severe fiscal consequences on themselves and the overall global economy. Examining the major components that make up China’s $375 billion deficit with the United States, it appears that $77 billion is comprised of Chinese-made computer sales, and another $70 billion comes from the sale of cell phones assembled in China. Although these electronic products are sourced from China, many are sold throughout the United States under product names that are not necessarily recognized by U.S. consumers as originating in China. Add in over $50 billion in shoes and clothing coming from China, and these three categories alone comprise half of the current Chinese trade deficit with the United States. It is difficult to imagine U.S. consumers willingly sacrificing their computers, mobile phones, and inexpensive clothing in exchange for a lower trade deficit with China. Most U.S. consumers do not care about the trade deficit; it just isn’t important to them in their daily lives. However, it is a fact that prices for these goods will skyrocket, and their availability will become a real challenge, if a trade war continues throughout 2019. From China’s perspective, there is no question that losing the U.S. market for just these three categories of products will leave a vast hole in China’s export capacity and harm Chinese manufacturers.

Now look at it from the standpoint of U.S. exporters. Of the $130 billion of U.S. exports sold to China during the same period, $16 billion was for U.S.-built aircraft; $10 billion was for American automobiles; and another $13 billion was for soybeans. Although the Chinese obviously consider all of these U.S.-made products as important and desirable, none are irreplaceable. Airbus SE, Europe’s Aerospace Consortium, would be delighted to dethrone Boeing as an aircraft supplier to China’s growing aviation market. Automobiles coming from the United States could be easily substituted by Japanese and European models. In addition, China blocked imports of U.S. soybeans in retaliation as the trade dispute escalated (although China has since backed off somewhat and promised to buy U.S. soybeans, but this can still change). In short, although the Chinese would definitely be hurt during the first six to twelve months of an escalating trade war, in the end China can and will find alternative purchasers for its exported products, albeit at lower prices. Without question, U.S. companies now exporting to China and with active Chinese operations will continue to feel pressure from Chinese authorities.

Next, think about the implications of the politics of a trade war between China and the United States. Much of the ongoing trade confrontation depends on the political wills of Donald Trump and Xi Jinping. As I describe in my recent book Asia Ascending, Xi Jinping today is the single most powerful political leader in the world. This is due to the unprecedented power and influence Xi has amassed over China during the last half decade. The best way to understand this is to picture China as a three-legged stool: the first leg is the Communist Party, which makes all policy and governmental decisions; the second leg is the centrally controlled Chinese economy; and the third leg is the immensely influential Chinese military. Few Americans understand or appreciate that Xi Jinping is China’s first leader since Mao to have complete mastery of all three legs of the stool. During the 19th Party Congress, Xi extended his existing term for at least another five years. Even more important, Xi has no identified successor(s), and is thus likely to rule over China for a very long time. So although China would definitely suffer during an extended trade war with the United States, Xi Jinping has the ability to sit back and play a long waiting game until a settlement is negotiated. On the other hand, if President Trump expects to run for re-election in 2020, he can expect to encounter significant criticism and political opposition if the current trade war extends beyond the next six months. The president is under tremendous pressure to arrive at an acceptable accommodation with China as he attempts to solidify his political base for re-election.

The bottom line is that because China is truly such a centrally controlled economy, it is in a better position than the United States (with its current highly politicized atmosphere) to hold out during a trade war. In addition, as the owner of almost 20 percent of the U.S. public debt, China can play the “no longer underwriting” card and begin to sell off its current U.S. debt holdings, which would inevitably drive up interest rates and accelerate a downturn in the U.S. economy.

Without question, China presents many serious challenges to the United States that must be proactively addressed. These challenges include China’s efforts to gain or purchase Western intellectual property by any means possible and China’s ongoing manipulation of its currency to its own benefit. These are problems that must be resolved between China and the United States over time. The United States can and should continue to use sections 301 and 201 of the Trade Act of 1974 as one approach to make China more open; however, an all-out trade war is not the right way—at least for now.

In a 64-page settlement agreement with the Department of Justice (DOJ), Skadden, Arps, Slate, Meagher & Flom has agreed to pay more than $4.6 million to the U.S. Treasury and register retroactively as a foreign agent of the Ukrainian government in a case tied to Paul Manafort. Under the Foreign Agents Registration Act (FARA), a U.S. person engaging in political activities on behalf of a foreign principal, which includes a foreign government, is required to register and make a variety of written public disclosures to the DOJ.

DOJ’s January 15 press release asserts that Skadden made false and misleading statements to DOJ’s FARA Registration Unit about the scope of the firm’s work for Ukraine, which began back in 2012. The statements were made to persuade the Registration Unit that Skadden was not required to register as a foreign agent under the statute. Skadden reportedly spent more than a year negotiating with the Registration Unit over whether it had to register as an agent of Ukraine in the matter. As such registration determinations are based on the evidence DOJ receives about whether registration as a foreign agent is required, either DOJ or the FARA Registration Unit may qualify as a “tribunal” under Model Rule 1.0(m). Lawyers are prohibited under Model Rule 3.3 from knowingly making false statements to a tribunal and, more generally under Model Rule 4.1, from knowingly making a false statement of material fact to any third party.

Questions leading to the firm’s settlement with DOJ came to light tangentially out of the Mueller probe. Suspicions apparently arose because the engagement letter provided that Skadden was going to charge the Ukrainian government 100 Ukrainian hryvnia per hour—equivalent to only $12,000. The press release reads that the law firm initially took a $4 million advance from a third party—an unnamed “business person”—before beginning work on the project. By the end of the engagement, Skadden had been paid $5.2 million by the “business person,” largely through Cyprus-based offshore firms controlled by Manafort.

According to the settlement agreement, “Registration under FARA would have required [Skadden] to disclose, among other things, accurate and complete information related to the compensation that it received for preparing the Report on behalf of the [Ukrainian government], and the identity of” the business person who paid for it. The settlement agreement also reads, “Skadden has already taken substantial steps to comply with its terms, and so long as the firm continues to comply with it, the Department will not undertake any action against the firm” related to its conduct in the matter.

Separately, however, the lead partner in the matter, a former Obama White House counsel who left Skadden last April, has reportedly been under investigation by prosecutors for his work on the matter. Another former Skadden lawyer, a Dutch national, pleaded guilty to lying repeatedly to Mueller’s team about the work done for the Ukrainian regime and was deported after serving 30 days in prison.

These facts if admitted or otherwise proved would constitute misconduct under various provisions of Model Rule 8.4 and can result in suspension or disbarment for the lawyers involved. Possible grounds include violating the Rules of Professional Conduct (R. 8.4(a)); committing a criminal act that reflects negatively on a lawyer’s honesty, trustworthiness, or fitness as a lawyer in other respects (R. 8.4(b)); engaging in conduct involving dishonesty, fraud, deceit, or misrepresentation (R. 8.4(c)); and engaging in conduct that is prejudicial to the administration of justice (R. 8.4(d)).

It is a quirk of the Bankruptcy Code that while it expressly allows oversecured creditors’ claims for post-petition contractual attorneys’ fees, it is silent as to the treatment of claims for post-petition contractual attorneys’ fees on unsecured claims. In part because the Supreme Court in Travelers Casualty & Surety Co. of America v. Pacific Gas & Electric Co., 549 U.S. 443 (2007) did not directly address the question whether unsecured creditors can recover post-petition contractual attorneys’ fees as part of their claims, courts continue to reach conflicting decisions. Very recently, in connection with a dispute arising out of the Tribune Company’s 2008 bankruptcy, Delaware District Judge Richard G. Andrews reversed the decision below and interpreted Travelers to mean that unsecured claims for post-petition contractual attorneys’ fees are not barred by Section 506(b) of the Bankruptcy Code. Wilmington Trust Co. v. Tribune Media Co. (In re Tribune Media Co., et al), Case No. 15-01116 9 (RGA), 2018 WL 6167504 (D. Del. Nov. 26, 2018).

Background

Wilmington Trust Company (the “Trustee”) was the trustee under an indenture for certain unsecured notes issued by Tribune Company (“Tribune”). The indenture required Tribune to reimburse the Trustee for the reasonable attorneys’ and other professionals’ fees and expenses incurred by the Trustee as a result of Tribune’s default. The Trustee submitted a claim in the Tribune bankruptcy that included more than $30 million for attorneys’ and other professionals’ fees and expenses incurred during the bankruptcy case (the “Fee Claim”).  

After Tribune objected to the Trustee’s Fee Claim, the mediator appointed by the bankruptcy court recommended that the claim be disallowed in its entirety. The mediator concluded that because Section 506(b) of the Bankruptcy Code addresses only secured creditors’ entitlement to post-petition attorneys’ fees as part of its claim, the expressio unius est exclusio alterius principle of statutory construction applied and precluded recovery of post-petition attorneys’ fees by unsecured creditors. 

The bankruptcy court adopted the mediator’s recommendation and disallowed the Trustee’s Fee Claim. In doing so, the bankruptcy court agreed with the reasoning in the mediator’s report—in particular, “the conclusion that the plain language of §502(b) and §506(b), when read together, indicate that postpetition interest, attorneys’ fees and costs are recoverable only by oversecured creditors”—and rejected the Trustee’s Travelers-based arguments with the explanation that the Travelers Court did not consider whether Section 506(b) of the Bankruptcy Code disallows unsecured claims for post-petition contractual attorneys’ fees.

The District Court’s Ruling

In a three-page memorandum opinion, Judge Andrews briskly dispensed with Tribune’s expressio unius argument and the bankruptcy court’s conclusion that because section 506(b) of the Bankruptcy Code expressly allows the claim of an oversecured creditor for post-petition attorneys’ fees, Congress must have intended to disallow such claims to unsecured creditors. 

First, Judge Andrews characterized the Supreme Court’s Travelers opinion as having “reaffirmed a requirement that claims that are within the scope of Section 502 are allowed unless they are expressly disallowed in the Bankruptcy Code.” Next, while noting that there continue to be reasoned bankruptcy and district court decisions to the contrary, he observed that “[t]he courts of appeals that have considered this issue post-Travelers have unanimously rejected Appellee’s position and have allowed unsecured claims for contractual attorneys’ fees that accrued post-filing of the bankruptcy petition.” Finally, taking the cue from Travelers, he said “I cannot conclude that Section 506(b) ‘expressly’ disallows the claims at issue here. Thus, I agree with the position adopted by every court of appeals faced with the question; Section 506(b) does not limit the allowability of unsecured claims for contractual post-petition attorneys’ fees under Section 502.”

Observations

As Judge Andrews observed, there has never been a nationwide consensus on the allowability of an unsecured creditor’s claim for post-petition contractual attorneys’ fees.  Because Tribune appealed Judge Andrews’ decision, the Third Circuit soon may have an opportunity to decide the issue. Whether it will take that opportunity remains to be seen, however; as of this writing, it has asked the parties to file briefs addressing whether Judge Andrews’ order, which remanded the case to the bankruptcy court for further consideration, is final or otherwise appealable. Putting aside potential jurisdictional defects, it is safe to say that a decision on the merits from another court of appeals—particularly if it joined the other courts of appeals that have considered the issue post-Travelers in allowing unsecured creditors’ claims for post-petition contractual attorneys’ fees—could strongly influence future courts’ decisions on this recurring question.