Supreme Court Holds that “But-For” Causation Is Not Required for Specific Jurisdiction

The U.S. Supreme Court issued an important ruling in Ford Motor Co. v. Montana Eighth District Court, 592 U.S. ___ (2021), on March 25, 2021 holding that it is not necessary to have a “but-for” causal link between the defendant’s forum contacts and the plaintiff’s injury to obtain specific jurisdiction.

Under the Due Process Clause a defendant must have “minimum contacts” with the forum state seeking to exercise jurisdiction over the defendant such that exercising jurisdiction does not “offend traditional notices of fair play and substantial justice.”[1] General or “all purpose” jurisdiction is available only when a defendant is “at home” in the jurisdiction.[2] But specific or “case-linked” jurisdiction is available where suits “arise out of or relate to the defendant’s conduct with the forum.”[3]

In a string of recent opinions—largely written by the late Justice Ginsburg—the Supreme Court had consistently reversed state court decisions that improperly blurred the lines between these two distinct approaches to establishing jurisdiction.[4] In Ford Motor Co. v. Montana Eight Judicial District Court, the Supreme Court addressed the “related to” prong of specific jurisdiction.[5] Does it require a “but-for” causal connection, or does it have a broader reach?

The Supreme Court reviewed two consolidated cases, with facts straight from a law school exam. In the first, Markkaya Gullet was killed when she was driving a Ford Explorer in Montana and the tread separated from the tire, causing the car to crash. Her estate sued Ford in Montana, raising design defect and other claims. But Ford had not sold (or designed or manufactured) that specific Ford Explorer in Montana. Instead, Ford designed and made that car in Michigan then sold it in Kentucky. Gullet bought the car used, years later, through an attenuated chain of dealerships and prior owners. In the second case, Adam Bandemer was seriously injured after he was riding in a Crown Victoria that crashed in Minnesota and the airbag failed to deploy. Bandemer sued Ford in Minnesota, raising various products liability claims. But again, Ford had not designed, manufactured, or sold that specific car in Minnesota. Ford sold it in North Dakota, and it was then purchased used, years later, from a third party.

Ford argued that Minnesota and Montana did not have specific personal jurisdiction because, although Ford sold and advertised the same type of car in each state, it had not sold those particular cars involved in the accidents in those states. So there was no “but-for” causal link between Ford’s in-state conduct and the injury to the plaintiffs, which Ford asserted was necessary for each case to “arise out of or relate to” Ford’s forum contacts.

The Minnesota and Montana state courts each upheld personal jurisdiction over Ford. They reasoned that Ford’s in-state activity—particularly advertising and selling the same kinds of cars (although not either plaintiff’s vehicle)—“related to” the injury, and thus sufficient.[6] Ford then sought certiorari from the Supreme Court.

The Supreme Court granted the petition to decide the case during its 2019 Term, but it later rescheduled the case to the 2020 Term due to the COVID-19 pandemic. Due to this change, only eight members of the Court would ultimately hear the case. Justice Ruth Bader Ginsburg—the Supreme Court’s long-time procedural maven and author of most of the Court’s recent cases on personal jurisdiction—passed away just weeks before argument. Justice Amy Coney Barrett, the newest Justice, did not participate.

The Court Declines Ford’s Further Narrowing

While many observers expected the Supreme Court to continue narrowing the scope of personal jurisdiction, oral argument suggested that the Justices were skeptical of Ford’s position and the Court ultimately voted unanimously to reject Ford’s arguments. Justice Kagan authored the majority opinion, holding that the Due Process Clause does not require the defendant’s contacts with the forum state to be the “but-for” cause of the plaintiff’s injuries. Rather, the Supreme Court focused on Ford’s cultivation of the State market for its cars, explaining that “[w]hen a company like Ford serves a market for a product in a State and that product causes injury in the State to one of its residents, the State’s courts may entertain the resulting ” because it “relates to” those conducts.[7]

After providing a background of the Court’s personal jurisdiction jurisprudence, Justice Kagan’s opinion explained that “[n]one of our precedents has suggested that only a strict causal relationship between the defendant’s in-state activity and the litigation will do.”[8] Instead, the Court’s precedents require that a suit “arise out of or relate to the defendant’s contact with the .”[9] As Justice Kagan explained, the “first half of that standard [arise out of] asks about causation; but the back half [relate to] contemplates that some relationship will support jurisdiction without a causal .”[10] While the Court stated that the “relates to” standard “incorporates real limits,” the Court did not limit the standard to only those cases where there was proof of causation.[11] This decision aligns closely with Justice Kagan’s questions at oral argument, which focused on the role of the “relate to” requirement.

The Court likened the decision to its prior decision in World-Wide Volkswagen Corp v. Woodson, 444 U.S. 286 (1980), in which the Court had stated that Audi and Volkswagen were subject to jurisdiction in Oklahoma for “purposefully availing” themselves of the state auto market, even when the sale was from a dealer in New York. Here, Ford’s extensive contacts with the forum states were critical to the “relate to” analysis. Ford advertises “by every means imaginable,” sells the exact models at issue at dozens of dealerships in each state, and “works hard to foster ongoing connections to the cars’ owners” through warranty and repair offerings—including selling replacement parts and encouraging owners to buy .[12] The Court’s decision makes clear that these contacts with the state sufficiently “relate to” the car accidents at issue:  Ford had advertised, sold, and otherwise serviced the market for the exact car models at issue within the forum states.

Justice Kagan distinguished the Court’s prior decision in Bristol-Myers Squibb Co. v. Superior Court, 137 S. Ct. 1773 (2017), which held that specific jurisdiction was lacking in California when non-resident plaintiffs sued in California for injuries allegedly arising from use of the prescription drug Plavix, even though those plaintiffs neither bought or used Plavix in California nor were injured in California. In Ford, by contrast, the plaintiffs were residents of the forum state, drove the cars in the forum state, suffered injury in the forum state, and Ford serviced the market for those cars in the forum state.

The Future: Line Drawing

While the Court did not bite on a “causation-only” approach to specific jurisdiction, the decision leaves significant uncertainty, especially for businesses. The Court focused on Ford’s cultivation of the in-state market for its cars. But Ford and other major automobile manufacturers engage in unusually extensive activities to cultivate a market, including large-scale advertising as well as supporting dealerships, a second-hand market, and repair shops.

The Court suggested in a footnote that if “a retired guy in a small town in Maine carves decoys and uses a site on the Internet to sell them,” then he would not be amenable to sue in “any state” if harm arises from the .[13] But many businesses fall somewhere between the two extremes on a spectrum from an individual making an isolated online sale and a company like Ford. an online-only business that engages in significant retail efforts with wide-reaching advertisement, but lacks a footprint in the state and does not specifically target a state market. Or consider a company with more limited advertising targets, or a few retail facilities in only some specific states.

It is not clear how the “relates to” prong will be resolved in between those two poles. The Court emphasized that the prong imposes “real limits.”[14] But the Court explicitly declined to address a hypothetical different case in which Ford marketed the models in only a different state or region. Likewise, the Court explained that its decision did not address “internet transactions, which may raise doctrinal questions of their own.”[15] Court accordingly left those issues for another day.

Justice Alito wrote a separate concurring opinion agreeing that jurisdiction was proper, but explained that he considered “arise out of or relate to” to be overlapping requirements, not two independent bases for jurisdiction.[16] He further noted that the Court’s decision created uncertainty about the meaning of “relates to.” Justice Gorsuch, joined by Justice Thomas, also concurred in the judgment. Justice Gorsuch questioned the applicability of these “old boundaries” of personal jurisdiction to the 21st century. After detailing the Court’s personal jurisdiction jurisprudence over the centuries, Justice Gorsuch admitted that he finished “these cases with even more questions than [he] had at the start,” and urged future litigants and the lower court to help them “sort out a responsible way to address the challenges posed by our changing economy in light of the Constitution’s text and the lessons of .”[17]

In Brief: Real Limits Remain, But Uncertainty About What the Limits Are

In many respects, the decision leaves the personal jurisdiction doctrine unchanged: In a mine-run case in which the defendant’s in-state conduct is the “but-for” cause of the plaintiff’s injury, then the “arises out of or relates to” prong will be satisfied, and the focus of the inquiry will be on the “purposeful availment” prong, as it was before. But the decision leaves significant open questions when there is not a “but-for” causal link. Such a link is not required—it is enough that the injury “relate to” the forum contacts. But courts still must grapple with what it means to “relate to” those contacts.

While the decision establishes that businesses are likely to be amenable to suit in the states which they advertise, sell, and service their products, it leaves open the question of whether less pervasive contacts within a forum will suffice to meet the “relate to” prong. As the Court explained, the standard has “real limits.” Where exactly those “real limits” are located, however, is largely open for further development.


[1] BNSF Railway Co. v. Tyrrell, 137 S. Ct. 1549, 1558 (2017).

[2] Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011).

[3] Bristol-Myers Squibb Co. v. Superior Ct. of Cal., San Francisco Cnty., 137 S. Ct. 1773, 1779–80 (2017).

[4] See, e.g., Bristol-Myers Squibb Co. v. Superior Court, 137 S. Ct. 1773 (2017); BNSF Railway Co. v. Tyrrell, 137 S. Ct. 1549 (2017); Walden v. Fiore, 134 S. Ct. 1115 (2014); Daimler AG v. Bauman, 134 S. Ct. 746 (2014); Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915 (2011).

[5] Ford Motor Co. v. Mont. Eighth Judicial Dist. Ct., No. 19-368, No. 19-369 (S. Ct. March 25, 2021).

[6] Bandemer v. Ford Motor Co., 931 N.W.2d 744 (Minn., July 31, 2019); Ford Motor Co. v. Mont. Eighth Judicial Dist. Court, 443 P.3d 407 (May 21, 2019). 

[7] Ford Motor Co., No. 19-368, No. 19- 369, slip op. at 1–2.

[8] Id. at 8. 

[9] Id. (emphasis in original).

[10] Id.

[11] Id. at 9.

[12] Id. at 11.

[13] Id. at 12 n.4.

[14] Id. at 9. 

[15] Id. at 12 n.4.

[16] Id. at 1–4 (Alito, J., concurring).

[17] Id. at 11 (Gorsuch, J., concurring). 

The Data Dilemma: Regulating the Lifeblood of Fintech Innovation

At the ABA Business Law Section’s Virtual Spring Meeting in April 2021, a panel of industry experts will discuss data aggregation and the role data aggregators play in today’s financial services market. The discussion will center around the CFPB’s Advance Notice of Proposed Rulemaking (ANPR) on Section 1033 of the Dodd-Frank Act and Consumer Access to Financial Records, including the goal of regulation and consumer consent and privacy considerations and also covered use cases for data sharing, consumer benefits and regulator coordination. The panel consisted of Thomas Devlin, Managing Counsel, Office of Regulations, CFPB; Meredith Fuchs, General Counsel, Plaid; Chris Hill, Assistant General Counsel, Finicity; Grace Powers, Assistant General Counsel, eCommerce, Technology, and Innovation, Wells Fargo and Christina Tetreault, Manager, Financial Policy, Consumer Reports. ABA Business Law Section members will also be able to watch the program for CLE credit on-demand and can register for free here.


Introduction

Data aggregation has long played an important role in consumer financial services. Whether done internally or through a third party, the ability to consolidate financial information and services can provide benefits to consumers. For example, a consumer may be able to send money to a friend, pay her electric bill, and book a vacation getaway all through her financial institution’s website. Financial service providers also benefit from data aggregation services by increasing touchpoints with their customers, streamlining account opening, and having access to more information for credit decisioning. However, the risks of unauthorized access to nonpublic personal information increase as more information is consolidated in a single location or as more entities pass the information.

The Emerging Landscape

In 2001, the Office of the Comptroller of the Currency (OCC) issued Bulletin 2001-12 addressing bank-provided account aggregation services. While the OCC recognized the potential value of these services, it warned banks of the risks involved in this emerging area, particularly when engaging third parties. The guidance ultimately served to encourage banks to employ risk controls when engaging in aggregation activities. The OCC stressed strong information security controls to protect against unauthorized access to consumer information, promoted robust authentication measures to enhance the security controls, and recommended thorough evaluation of third parties to ensure the security of all information and compliance with all legal requirements. The guidance also noted the importance of disclosing the terms of the aggregation service and scope of the bank’s authority to use the customer’s information in customer agreements.

Since Bulletin 2001-12, data aggregation has expanded dramatically. The parties involved are no longer just banks and their third-party service providers. The lines between data holder, data aggregator and data user have blurred as both banks and non-bank providers have evolved. The sophistication of the parties and how they collect information has also changed.

Today, data aggregation is primarily done using application programming interfaces (APIs) and screen scraping. An API is an application that allows multiple systems to be compatible with one another to facilitate data flowing between the systems. The data user generally must conform to a set of standards or application terms in order to use a particular API. Screen scraping, which is less common than using APIs, is a computer program that will read public information on a website and copy such information. Depending on the sophistication of the program, it can copy all information from a site or target specific types of information. A screen scraper program may input the information collected into various formats, including into an electronic database or into an API to be shared with other data users. In either case, the application or program is operating in the background and does not necessarily impact the consumer experience.

In March 2020, the OCC once again addressed risk management concerns with data aggregation in Bulletin 2020-10. Under this guidance, data aggregators are “entities that access, aggregate, share, or store consumer financial account and transaction data that they acquire through connections to financial services companies.” The guidance noted that while a bank does not need to have a direct relationship with a data aggregator to share information authorized by the consumer, those who do interact with an aggregator should have sufficient controls in place. FAQ #4 explained that “[i]nformation security and the safeguarding of sensitive customer data” remains a key consideration for risk management of these relationships regardless of whether the bank has a direct relationship with the third-party data aggregator. Banks with direct relationships have higher risk management expectations. Employing strong vendor management controls, including due diligence and ongoing monitoring, is vital to ensuring the security of customer information.

The CFPB’s Role

The Consumer Financial Protection Bureau (CFPB) is also becoming more active in this space. While the OCC tends to focus on safety and soundness issues for banks, the CFPB has taken a more consumer-focused approach. In 2010, Congress passed the Dodd-Frank Act, including Section 1033[1] which provides consumers with a right to access their financial data. Section 1033 generally requires financial service providers to make available to a consumer information it has related to that consumer.

The CFPB announced its Consumer Protection Principles for Consumer-Authorized Financial Data Sharing and Aggregation in 2017. In the Principles, the CFPB observed the important role non-bank providers have in providing consumers with access to financial management tools, account verification, fraud prevention, and other services. Since these providers often need access to nonpublic personal information in order to provide these services, the CFPB stressed the need to keep consumers in mind when designing information-sharing policies and obtaining consent. Nine key principles were identified: access; data scope and usability; control and informed consent; authorizing payments; security; access transparency; accuracy; ability to dispute and resolve unauthorized access and efficient and effective accountability mechanisms.

In November 2020, the CFPB issued an ANPR on Consumer Access to Financial Records to implement rulemaking under Section 1033. In the ANPR, the CFPB recognized the changing industry dynamics regarding data aggregation and sought feedback on topics including the scope of consumer access, consumer control and privacy and data security. In its discussion, the CFPB noted the rise of non-bank providers and how the increased overlap between data holders, data aggregators, and data users complicates how consumers can access their data. The CFPB also noted that these changes play an important role in the market for financial products and services in the form of increased competition leading to new and improved products, broader access, and lower consumer costs.

The CFPB asked for comprehensive feedback from the industry to help it understand the best course of regulatory action. Regarding the scope of data access, the CFPB sought input on what types of data holders should be covered, how to address confidential information not subject to the right of access, and whether other information should be excluded from access. Regarding consumer control and privacy, the CFPB sought input on both primary and secondary uses of data and how to ensure consumers better understand how their data is being shared and used. Regarding data security, the CFPB sought input on existing law and incentives to keep consumer data secure. Other topics for input included costs and benefits of consumer data access, competitive incentives, and data accuracy. The comment period for the Section 1033 ANPR closed on February 4, 2021, and the CFPB’s rule or other response to the ANPR comments has yet to be published as of this writing.

Conclusion

Despite the many legitimate use cases and potential consumer benefits of data aggregators, a number of risks remain. Consumer protection advocates point to the consent and privacy implications citing a consumer’s need to understand how his data is being used and shared. The evolving state privacy law landscape and lack of a federal privacy and data security standard remains an open question on how to address these issues in the data aggregator space. Ultimately, how the CFPB decides to implement Section 1033 will have a substantial impact on this sector of the industry and it remains to be seen how regulatory intervention will affect progress and innovation.


[1]  12 USC § 5533.

Sweepstakes, Contests, and Giveaways: How Business Lawyers Can Avoid Traps, Pitfalls, and Giving Bad Advice

One of the most important parts of a business lawyer’s job is developing a firm understanding of his or her clients’ work. Knowing where a client is situated within its industry, how it arrived there, and where it aspires to be in the future is critical to a business lawyer’s ability to guide the client through a difficult situation or assist it in taking steps toward accomplishing its goals. We need a working familiarity with our clients’ regular operations, procedures, policies, and practices in order to counsel them in the matter at hand and to be prepared to represent them in the matter that’s lurking around the corner.

But what happens when a client wants to try something different? Not a change in direction or identity, but a new way to promote a service or engage with potential customers. A giveaway to generate buzz about a new product? A raffle to raise funds for a nonprofit client? If Oprah and HGTV can promote sweepstakes for their viewers, why can’t your client? What exactly is a sweepstakes, again?

Even amidst the sports wagering craze that has followed the Supreme Court’s 2018 decision in Murphy v. NCAA, most people—attorney and layperson alike—have a pretty good sense that gambling generally is illegal or, at least, very highly regulated. But a raffle or a product giveaway seems safe and easy, right?

Of course, there’s no brighter line or bigger obstacle in this area than those that describe the concept of gambling. Because most gambling regulation occurs at the state level, legal definitions of and exceptions to gambling prohibitions can vary across jurisdictions. Usefully, however, these definitions commonly tend to reduce to three elements: (1) consideration to play (2) a game of chance for (3) an opportunity to win a prize of monetary value. A proposed activity usually qualifies as gambling (and, absent a specific exemption, usually therefore is illegal) if it satisfies all three of those elements. On the other hand, omission of even one of these elements can mean the activity in question is not gambling, and the activity therefore may be lawful. Thus, a raffle with free entries may be a fun and legally compliant way for a lucky raffle-entrant to receive a bicycle (even if it isn’t the most direct way for the raffle’s sponsor to make money).

Bypassing the pay-to-play aspect (element 1) of an activity is not always as easy as it might appear. Is it sufficient if participants may but aren’t required to pay, or must the organizer prohibit all participants from paying? The distinction can make a material difference. More broadly, consideration in this context is not confined to money and could appear in the form of a requirement that people engage with or subscribe to a company’s social media feed.

Whether the activity in question is one for which the outcome depends on skill or chance (element 2) or a particular blend of both can present an especially fact-dependent analysis in which different states take different approaches. Some jurisdictions may affirmatively define certain popular activities as being games of skill or chance for legal purposes. Keep in mind that although some committed or successful participants might contend that outcomes are due to the player’s great adeptness for an activity, those mere contentions are unlikely to provide a useful counterpoint to a legislative or regulatory determination to the contrary.

Sweepstakes are contests of chance in which participants may enter to win a prize but need not pay to enter nor, usually, may increase their odds of winning by paying to enter. They merit their own discussion because they tend to be the specific subject of regulation or prohibition in many jurisdictions. This regulation has served to popularize phrases such as “no purchase necessary” to enter (a reference to “alternative method of entry”), “self-addressed stamped envelope,” and “universal product code.” In some areas, the familiar sweepstakes operated by Publishers Clearinghouse, McDonald’s, and Pepsi have given way to sweepstakes cafes, parlors, or game rooms, which exist in gray areas of uncertain legal propriety. While the operators of these conventional and modern sweepstakes are in the business of sweepstakes, rather than companies looking to use a sweepstakes to promote an otherwise independent consumer product, examination of their conduct is useful for understanding how states regulate sweepstakes. The regulations often include requirements that can feel onerous to an entity contemplating a sweepstakes as an ancillary promotional activity rather than its primary business. For example, state regulations may include obligations to publish detailed rules, provide notices, register with the government, and provide bonds for prizes above certain values.

Fantasy sports, which operators and proponents alike have long argued is a contest of skill such that consideration and prizes are allowable, also merit discussion. Several states have passed legislation expressly authorizing fantasy sports, including daily fantasy sports (“DFS”), while others have found it to be a prohibited form of gambling. Some of those legislative edicts, in turn, have been subjected to judicial scrutiny under applicable state constitutional tenets. Increasingly, though, battles over the legality of DFS are giving way to new policy initiatives involving the authorization of traditional in-person and mobile sports wagering.

When researching an applicable jurisdiction’s law addressing these types of activities, remember that different states take different structural approaches to legislating and regulating in this area. In some states, a gaming commission or board may be the applicable governing body, while in others it may be a lottery agency, department of revenue, or even the department of agriculture. Still others may take a stripped-down or decentralized approach, leaving the matter to the state’s penal code and enforcement by a patchwork of statewide, county, or local law-enforcement officials.

Sweepstakes, contests, and giveaways can be exciting and effective ways for clients to promote their businesses. While business lawyers need not be specialists to be able to spot major legal issues in this area, consultation with someone familiar with the applicable jurisdiction’s regulatory particularities is recommended.

Virginia Governor Signs Nation’s Second Comprehensive Consumer Data Privacy Law

On March 2, 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act[1] (“VCDPA”) into law. By enacting the VCDPA, Virginia becomes the second state nationwide to implement a comprehensive consumer data privacy law, following  the California Consumer Privacy Act[2] (“CCPA”). While the VCDPA is similar to the CCPA in many respects, the VCDPA has a different scope and different obligations than the CCPA. Accordingly, impacted businesses must conduct a separate scope analysis, and they will need to set up different business rules to comply with the VCDPA if they are subject to it.

Application

The VCDPA applies to persons that conduct business in Virginia or produce products or services that are targeted to Virginia residents and that either (i) control or process personal data of at least 100,000 consumers during a calendar year, or (ii) control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data. The VCDPA applies to information that is linked or reasonably linkable to an identified or identifiable person acting in an individual or household context. The law also provides special protections for sensitive data, which includes personal data including certain demographic, biometric, or location information, along with information on a known child.

However, the VCDPA does not apply to, among other things:

  • financial institutions[3] or data[4] subject to the federal Gramm-Leach-Bliley Act;
  • certain activities[5] regulated by the Fair Credit Reporting Act;
  • information on persons acting in a commercial or employment context;
  • deidentified data; or
  • publicly available information.

The VCDPA imposes different obligations depending on whether the business is a controller (the person that determines the purpose and means of processing personal data) or a processor (the entity processing personal data on behalf of the controller). Therefore, a business will need to analyze whether it is acting as a controller or a processor when engaging in any personal data processing.

Consumer Rights

The VCDPA provides consumers with a number of rights related to their personal data, several of which are similar to rights available under the CCPA. Under the VCDPA, consumers have the right to:

  • confirm whether or not a controller is processing personal data;
  • access their personal data;
  • correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes for processing the personal data;
  • delete personal data provided by or obtained about them;
  • obtain a portable copy of personal data that they previously provided to the controller; and
  • opt out of the processing of personal data for:
    • targeted advertising,
    • the sale of personal data, or
    • profiling

Controller Obligations

The VCDPA requires controllers to, among other things:

  • limit collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such personal data is processed, as disclosed to the consumer;
  • not process personal data for purposes that are not reasonably necessary or compatible with disclosed purposes, unless the controller obtains consumer consent;
  • establish, implement, and maintain data security practices;
  • not process personal data in violation of discrimination laws;
  • not process sensitive personal data without consent; and
  • clearly and conspicuously disclose if it sells personal data to third parties or processes personal data for targeted advertising and disclose the manner in which a consumer can exercise his or her opt-out rights.

Controllers must provide consumers with a that includes certain information about personal data processed by the controller.

The VCDPA requires a data protection assessment to identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks. The use of de-identified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed, shall be factored into this assessment by the controller.[6]Controllers must conduct and document data protection assessments when engaging in the following activities:

  • the processing of personal data for purposes of targeted advertising;
  • the sale of personal data;
  • the processing of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of certain types of harm to consumers;
  • the processing of sensitive data; and
  • any processing activities involving personal data that present a heightened risk of harm to consumers.

Processor Obligations

A processor must follow a controller’s instructions and must assist the controller in:

  • responding to consumer rights;
  • meeting breach notification obligations; and
  • providing information to enable the controller to conduct and document data protection assessments.

There are also requirements for contracts between controllers and processors.

Enforcement

The Virginia attorney general has exclusive authority to enforce the VCDPA, and may seek civil penalties of up to $7,500 for each violation of the VCDPA, in addition to injunctive relief.

The VCDPA does not contain a private right of action.

Effective Date

The VCDPA will become effective on January 1, 2023.


[1] Va. Code Ann. §§ 59.1-571 et seq.

[2] Cal. Civ. Code §§ 1798.100 et seq.

[3] 15 USC § 6809.3.

[4] 15 USC § 6809.4.

[5] e.g. “The collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the federal Fair Credit Reporting Act (15 USC §§ 1681 et seq.).” Va. Code Ann. § 59.1-572.

[6] Va. Code Ann. § 59.1-576(B).

Business Law Today Spotlight: Priya Huskins on SPAC-Related Litigation

The following conversation between Lisa J. Stark and Priya Cherian Huskins took place in advance of the American Bar Association Business Law Section’s Virtual Section Annual Meeting in September 2020.


LISA: Welcome to Business Law Today’s Spotlight Series. This is Lisa Stark, incoming Chair of Business Law Today. I am fortunate to be joined by Priya Cherian Huskins. Priya serves on the board of Woodruff Sawyer & Company, a 100-year-old commercial insurance brokerage. She chairs Woodruff Sawyer’s D&O claims group, and is an expert on the topic of D&O insurance.

Priya recently authored “Why More SPACs Could Lead to More Litigation (and How to Prepare),” an article published in Business Law Today which discusses the dramatic increase in IPOs this year lead by SPACs (special purpose acquisition companies). In her article, Priya anticipates an increase in SPAC-related litigation and gives some practical tips for avoiding SPAC-related litigation. Priya, what is a SPAC?

PRIYA: In simplest terms, the idea is that a group of individuals, the SPAC sponsors, will raise money in an IPO and then go forth and find a good company to acquire. The SPAC is the special purpose vehicle used to accomplish the task.  The IPO money is put into a trust, and the sponsors have 18-24 months to find a suitable target. Shareholders can then either accept the transaction or redeem their money.

LISA: Perfect. So why are we seeing more IPOs by SPACs right now?

PRIYA:  I don’t really know the answer. But I can observe that some of the rules regulating these vehicles have loosened up a bit. Also, we are in a low interest environment where investors are clamoring for returns. I’d also observe that success begets interest. So that explains perhaps the explosion in SPAC popularity right now. There is no doubt that a wave is now barreling towards us, but like most waves, it’s actually not that sudden. Momentum for SPACs has been building for a while now. And I think the last element is that SPACs create a way for companies, private companies to go public. And that is very compelling in the environment where market volatility makes a traditional IPO a little bit more risky for operating companies.

LISA: And it’s that risk element that we’re going to focus on today. What are the different types of SPAC-related litigation that might follow all of this increase in SPAC activity?

PRIYA: SPAC-related litigation can be usefully placed into five categories. And these categories track the SPAC lifecycle. So, first one, SPAC IPO suits. Now, this is actually a theoretical category. To date, we have seen no securities class action lawsuit filed against a SPAC IPO registration statement. But, for completeness, that’s where we should start. The second category, merger objection suits challenging the proposed merger. Now, these are actually quite common, and in many ways look, smell, and feel exactly like all of the other merger objection suits we are used to seeing in the public company environment. The third category is merger failure suits. And this category is the one that arises when a SPAC completes the merger, and only later the true condition of the target comes to light. And of course the true condition, if there’s litigation, is not good. The fourth category, is securities class actions against the operating company.  Remember that the point of the SPAC transaction included having a private company become a publicly-traded company. And like any publicly-traded company, that company is subject to stock drop litigation. The last category, the fifth one, is bankruptcy. I mention this in particular because if, after the merger closes, the target company ends up going bankrupt quickly, sponsors should expect that they may also, or at least the SPAC, may also be brought into bankruptcy-related litigation.

LISA: Sounds a bit messy.

PRIYA: It could be.

LISA: It could be. So, you mentioned sponsors. SPAC acquisitions are often related party transactions with a SPAC its sponsor and/or the target often having some overlap in terms of directors, stockholders, and management. Are there any litigation-related issues that we should be concerned about given the conflicts that are inherent in these types of IPOs?

PRIYA: Absolutely yes. SPACs are exciting, and there is nothing about them that erases all the normal fiduciary duty issues that are always implicated by M&A deals that may have related parties involved. The few cases that have gone to litigation for SPACs all feature a lot of conversation about the sponsor’s incentives. People involved in SPAC transactions are well advised to brush up on the law when it comes to independence in the context of M&A transactions. And remember, it’s not just financial relationships that can be problematic. Social relationships can also cause independence problems as well.

LISA: Friends, family, and golf buddies, right?

PRIYA: That’s right.

LISA: Are there any recent SPAC-related lawsuits that our audience should know about?

PRIYA: I am very interested in the fact that there have been some pretty messy pieces of SPAC-related litigation. Again, it’s the M&A context that tends to be the most interesting. The classic case is the Heckmann Corporation case. This is sometimes known as the China Water case. This is a slightly older case, but it is very instructive. Because it has all of the elements that I am talking about where there is a target, there is a proxy, the deal closes, and after the deal closes it looks like it wasn’t a terrific deal. And remember too that sponsors of the SPAC see a tremendous upside if they can successfully close the deal. And what looks like an economic win can later be recharacterized in litigation as an improper incentive.

LISA: It’s that incentive that creates the conflict that causes public shareholders to sue. So finally, I think this is maybe the most helpful part of the conversation. How can SPACs, their sponsors, and target companies reduce risks related to litigation and ultimately reduce litigation?

PRIYA: Sure. First, I actually want to mention that we tend to think about civil litigation, plaintiff litigation, when we think about SPACs and this kind, these kinds of transactions. But just as a quick reminder, the SEC may also be interested in what’s going on. I haven’t seen much hand wringing and the kind of warnings that we’ve seen for other innovations, think initial coin offerings from the SEC. But they haven’t failed notice what’s going on. Might be useful to consider the June 2019 enforcement action against Benjamin Gordon. He was the CEO of Cambridge Capital Acquisition Corp. He agreed to a cease and desist, a personal fine of $100,000, and a 12-month bar from working with anything really associated with the SEC. And the SEC is also pursuing the principles of the target of the SPAC transaction ability computer. So, a lot went wrong in that deal, possibly some outright fraud. And, when you read through the SEC’s press releases and related documents, it’s very clear that the SEC was focused on the proxy statement’s disclosure that Cambridge Acquisition Corp. had conducted thorough due diligence. They’re focused on that because they kind of don’t think that’s true. So that’s a starting point, as much as we all care very much about plaintiff-style litigation, there is nothing scarier than when the government is coming after you. Anybody affiliated with a SPAC may want to just remember that this is a regulated situation, and the SEC and ultimately the DOJ has jurisdiction.

Now let me talk about what is, because I started with the SEC, the more friendly part of litigation. So, when we think about how can SPAC sponsors protect themselves from litigation, a couple tips. First and foremost, and we talked about this a little bit already, treat the M&A process with the same level of diligent effort that you would if you’re on the board of a public company doing the deal. It’s not going to be okay to be fooled by the target since you are the one asking investors to read the proxy materials and vote for the transaction. The diligent effort and the documentation of the diligent effort is exactly the same as it would be in any other situation. Another tip is to be timely in your efforts to find a target. It’s notable how many of the SPACs that end up in litigation were at the very end of their timeline, and basically were in the position of heroically throwing an acquisition target across the finish line. Given the upside that sponsors experience from closing a deal, this is a recipe for extreme skepticism by the court if the deal has any problems.

Finally, buy good D&O insurance from a broker who actually understands the entire SPAC lifecycle and its attendant risks. There is a lot of insurance out there being slung by insurance brokers who are very junior, know very little about the current D&O litigation environment, and are slamming together expensive D&O insurance policies without really knowing what the policies are supposed to cover. Remember, your broker isn’t just taking orders for insurance policy limits. The policies are negotiated, they’re bespoke, very customized. If you have a claim, you will hope that the individual who placed the policy can actually advocate for you with the carriers. Not all brokerage houses are set up this way, so you’re going to want to ask about your broker’s experience, not just with placing the SPAC IPO insurance, but about getting claims paid for IPO companies, about M&A transactions and claims payment, perhaps in warranties policies and claims payment.  And of course, working with operating public companies of the type that you’re going to have on your hands after the SPAC transaction.  I have to tell you, some of the best deals my insurance brokerage has ever worked on are deals our clients walked away from due to what we uncovered in the insurance diligent process of all things. So, working with an insurance broker who can take a holistic integrated approach to the entire SPAC lifecycle is much, much better than relying on a junior broker who will need to hand you off to another silo at the very next stage of the SPAC lifecycle, or if there is a claim against the insurance.

In summary, be diligent, be timely, and don’t forget to put some early attention on the D&O insurance.

LISA: Thank you so much, Priya. This has been a fascinating conversation. Again, Priya’s article is called “Why More SPACs Could Lead to More Litigation (and How to Prepare).” Thank you so much for joining our Business Law Today spotlight series. And Priya, thank you so much.

PRIYA: Thank you very much.

What to Look for in the Income Statement, Especially in Troubled Times

This is the second in a series of articles intended to provide a working knowledge of financial statements, terms, and concepts, especially as that knowledge is useful in the practice of law. For business lawyers, the language of business is finance, and it pays to be equipped to understand the business dimension as well as the law.    

The first article gave an explanation of the balance sheet. The present article seeks to explain how to best capture the information shown in the income statement.

Big Picture

At the broadest level, the income statement reports for a specific, discrete period of time (typically a year or a quarter) a company’s revenues, expenses, and earnings (i.e., profit or net income). This statement describes the company’s business model—how it makes money and (like the other financial documents) provides information about the performance and activities of the company. When you read a company’s income statement, consider the results in both an absolute and relative sense. How well does it appear to be doing, do things appear to be getting better or worse, and how does the company’s performance compare to that of its competitors? This information is particularly critical during unusual economic times (either good or bad). Management may actually be outperforming its competitors, despite what look like disappointing numbers.

Readers of the income statement are also looking for hints about the company’s future performance. Are the results you see likely to be indicative of future prospects, or are changes happening, good or bad? Are these changes likely to have a long-term impact or only a short-term one? Is the company gaining market share or losing it relative to its competition? Are there new entrants in fact or on the horizon? Is there disruptive technology that the company should be concerned with? For instance, might virtual meetings hurt airline ticket sales on a permanent basis? Further, does the company’s bargaining power appear to be getting better or worse, relative to its suppliers and customers? Answers to questions like these will help you get a feel for how the company is likely to do in the future, and the income statement contains information that can provide valuable insights into all of these areas. Don’t forget to read the MD&A (Management’s Discussion and Analysis). Not only does management explain much of the story behind the numbers, it also provides some level of prognostication about its view of the future.

Revenues—the Top Line

Revenue represents the value of the goods and/or services delivered to customers over the reporting period. Revenues constitute one of the most important lines of the income statement. A company can exist only to the extent that it is able to generate sufficient revenues to cover all of its costs and provide a return to its investors. What’s more, revenues often provide an important indication of a company’s relative strategic position.

A basic analysis of reported revenue looks at both the absolute amount and the rate of growth or decline over the last few periods. This leads to questions about the underlying drivers of revenue. Were the results an aberration, or were they indicative of the company’s current trajectory? To what extent are changes in revenue the result of price changes versus volume changes? Consider the context. In a period of crisis, such as COVID-19, revenues fell for many companies, but others have thrived. How did the company’s performance compare with that of its industry peers? What long-term industry shifts might be happening, and how are they likely to impact the company?

In our last article we discussed how the judgment inherent in the balance sheet has to do with the value of the line items. The critical judgement in the income statement is not value but timing. The income statement reports on activity over a specific period of time, based on the transactions that happened during the period. Judgment must be used when a transaction started in one period but was completed in a subsequent period; simply put, in which period should we report this transaction? At the risk of oversimplification, the Generally Accepted Accounting Principles (GAAP) rules are fairly straightforward; as long as the company either has been paid or has a reasonable belief that it will be paid, revenue is reported in the period in which the product or service was delivered. In some cases, this is easily determined; for a retail store, revenue is recognized when the customer pays for and takes the product. But in many cases, this is not a simple matter. For example, a technology firm may provide an integrated solution to its customer that takes three years to implement; clearly, how the total project is spread over the three years is a subjective matter.   

About half of all securities fraud cases have traditionally involved revenue recognition. Yet, the fact patterns often make the rules difficult to apply and sometimes counterintuitive for the reader. It is always advisable to read the company’s footnote describing its revenue recognition policies (normally Footnote 1), as well as the company’s MD&A to get a complete picture of what the company’s revenue numbers should be telling us. 

Expenses

Expenses represent the value of the resources used to create the product or service provided to customers. If revenues are declining during an economic downturn, a key question is to what extent the company can cut its expenses correspondingly. To the extent that it can, it is more likely to survive the downturn. Of course, one ought to consider the longer-term effects of cost cutting. For instance, if skilled workers are laid off and business later picks up again, will they be available? What will be the future impact of a company reducing its research and development costs to survive a downturn? Consider also the competitive context. For instance, if the company is better able to weather the downturn than its competitors, then maybe it may gain competitively merely by surviving. Sidebar 1 explains the geography of a typical income statement.

Sidebar 1: The Geography of an Income Statement

The first expense line item is typically “cost of sales” or “cost of services.” This represents the direct cost to the company of making or procuring the goods or services that it sells. In the case of a retailer, that is pretty simple—the cost of buying the umbrellas, paper towels, or the like—and typically warehousing and transportation costs. In the case of a manufacturer, it includes all of the direct costs of making the goods (i.e., the direct labor and raw materials), as well as overhead costs like depreciation, utilities, insurance, benefits costs, supervision, and the like. Cost of sales is a much more difficult number to get exactly right for a manufacturer than for a retailer. The net of revenues minus cost of sales is the gross profit or gross margin. A higher gross profit suggests that the company has fairly strong pricing power. 

Next comes the operating expenses—the costs of such activities as sales and marketing, research and development (or “R&D”), and administration (the CEO, COO, CFO, lawyers, etc.).  Operating expenses includes all of the costs of running the company that are not directly involved in making or procuring the goods or services sold. Gross profit minus operating costs yields operating profit. This is a crucial number, as it tells us what the company earned from its operations. That is the amount that is available to the lenders, the taxing authorities, and the shareholders. 

Operating profit is sometimes used interchangeably with EBIT, the earnings before interest and taxes.  The operating profit divided by revenues is the operating margin, a key ratio. A high percentage indicates that the company is enjoying solid operations, though what constitutes excellent operating margins in one industry might be poor in another. For instance, what would be great operating margins in the grocery business would be poor for a real estate investment company—as witnessed by Kroger’s 3.2 percent operating margin in the quarter ending May 31, 2020, as contrasted with Boston Properties’ 30 percent operating margin in the second quarter of 2020. Net income is the amount of operating profit available to the shareholders after the allocations for taxes and interest. This can be measured by net margin, the net income as a percent of revenue,

We make a very important distinction between “costs” and “expenses.” Cost is the value of any resource acquired by the company. Inventory held for sale, the equipment to run a factory, and salaries to employees are all costs. Costs are shown in two places on the financial statements. “Capitalized” costs are shown as assets on the balance sheet. These are costs that will benefit the company in the future. “Expensed” costs are shown as expenses on the income statement, representing the resources used by the company during the reported period. The timing of “expense recognition” (when the costs are capitalized or expensed) is driven by something known in GAAP as the “matching principle.” Essentially, it says that expenses should be recognized on the income statement in the same period as the revenue that they helped generate. (Of course, the matching principle may be superseded in certain situations by specific accounting rules relating to a type of cost or expense.) All costs will become expenses sooner or later, though some may be expensed as they are incurred, while others may be capitalized through the balance sheet and appear on the income statement at a later date. An example of how this works is if a company buys a piece of equipment to manufacture the product that it sells. If that equipment has an expected useful life of five years, the company will show the cost of the equipment on its balance sheet and spread that cost over the five years that it realizes the benefit of the equipment as depreciation expense.

It can be useful to distinguish operating costs from financing costs. Operating costs are those related to the operations, such as making paint, operating a trucking company, writing software, or running a baseball franchise or law firm, whereas financing costs are those related to financing the business, such as lenders and shareholders that provided the funds to start or grow the company. Only operating costs are considered in calculating operating income.

With respect to operating costs, thinking in terms of “fixed” and “variable” costs can be useful. Variable costs are costs that are directly, inexorably related to the volume of goods produced or sold. Examples of variable costs include cost of materials and sales commissions; when volume increases, these costs automatically increase. Fixed costs are not directly related to volume. Examples include rent for the factory building. “Fixed” does not mean constant; fixed costs change regularly. But the changing fixed costs is a decision by the company, whereas variable costs change directly as a function of changes in volume. Sometimes it is very difficult to determine if a particular cost is fixed or variable; such costs are considered “semi-variable.”. 

If a company is experiencing a severe downturn and is trying to survive, it is crucial to have an understanding of its fixed and variable costs. While its variable costs will decline along with revenues, its fixed costs will be unchanged, and high fixed costs are likely to cause the company to lose money in times of distress. On the other hand, it is also critical to understand which fixed costs require the immediate expenditure of cash, versus noncash expenses that either require no cash outlay (depreciation, for example) or will require a cash outlay only at some point in the future (such as deferred taxes and restructuring reserves).  Because of these noncash expenses, not uncommonly companies experience significant operating losses during economic downturns, while at the same time generating positive cash flows from operations. 

Sidebar 2: How the COVID-19 Downturn Impacted a High Fixed Cost Business (Delta Airlines)

It’s no secret that airlines are a classic example of companies for which fixed costs are a very high percentage of total costs, and the incremental cost of carrying the next passenger is usually quite low. Thus, when COVID-19 hit and air travel dropped dramatically, airlines had a very hard time managing costs. 

In the second quarter of 2020, Delta Airlines’ revenues dropped 88 percent from the 2019 second quarter, resulting in an operating loss of $5.7 billion for the quarter versus an operating profit of $1.4 billion during the same period of the prior year. To protect itself, Delta cut back on the number of flights it offered, reducing its fuel costs by 84 percent and maintenance expenses by some 89 percent, instituted a hiring freeze, offered pilots early retirement, and reduced salaries by 50 percent and 25 percent for its officers and directors, and about half its workforce took a voluntary unpaid leave ranging from 30 days to 12 months.  Yet despite cutting its operating expenses, 40 percent for the quarter, due to the high fixed costs Delta still had a loss for the quarter.

It is common to see large restructuring charges on the income statements of companies during periods of economic crisis. This occurs for two reasons. First, the company may decide to downsize and will set up a reserve for the actions it plans to take when it makes that decision, even though the downsizing may take several periods to enact. In addition, the current economic situation may have made the company reassess the value of assets on its balance sheet (including goodwill); to the extent that management feels that the value of any of these assets has been impaired, it will record an impairment charge as an expense. While both of these practices are not only proper but required under GAAP, sometimes management may tend to overstate these expenses during a downturn, with the idea of improving the appearance of its operations in future periods. Since these expenses tend to be noncash expenses, they will not impact cash flows from operations. The best way to understand the reasoning behind such charges is to read the notes to the financial statements and the MD&A.

Summary

The income statement tells us for a given period how much revenue a company generated, what expenses it incurred in doing so, and what earnings it netted. We can use it to understand a company’s business model and gain a sense of a company’s competitive position within its industry. For public companies, the MD&A provides a huge amount of useful information about revenues and expenses, as well as some indication of what we should expect for the future. The notes to the financial statements provide essential information about the key accounting policies and judgments used in generating the financials. These documents are especially critical during times of economic distress. As important as the income statement can be by itself, it takes on added importance when it is viewed in relation to the balance sheet, which shows the assets and capital the company required to generate its revenues and profit, and provides essential information about the sustainability of the company’s current operations.

Keep in mind that the income statement is an accrual document, not a cash document.  For instance, revenues are booked when they are earned, and costs are often expensed when they are incurred regardless of when cash changes hands. To follow the cash, the key document is the cash flow statement, the subject of the next article in this series.

Should Congress or the SEC ‘Do Something’ About Stock Buybacks?

Summary

The Securities and Exchange Commission (SEC or Commission) should not heed the advice of some critics who urge it to repeal its safe harbor for stock buybacks.[1] Repealing the SEC’s Issuer Repurchase Safe Harbor only will reintroduce legal uncertainty for issuers and will not address the critics’ concerns about pay disparities.  Additional disclosure is a better answer.

Critics of Rule 10b-18 (17 CFR § 240.10b-18) believe it is bad for the country because they claim that:

  • it furthers the income disparity between senior managers of public companies and the wages of average workers;
  • senior executives may use buybacks to manipulate triggers for overly generous executive compensation payments; and
  • curtailing stock buybacks would cause public companies to spend more of their resources on better pay for workers or for investments in research and development.

Repealing Rule 10b-18 would not be wise policy for several reasons:

  • Repealing Rule 10b-18 would reintroduce legal ambiguity that could harm issuers seeking to alter their capital structures for any reason.
  • Discouraging repurchases would not cause issuers to issuers to redirect resources to higher compensation for workers or for research and development. Achieving those goals would require the federal government to dictate the specifics of corporate management to issuers.
  • Eliminating the rule only would cause issuers to use different approaches that achieve some of the same goals, but at investors’ expense. Instead of repurchases, issuers could return capital to their investors by declaring dividends, triggering ordinary income for investors.

The federal securities laws are not an effective means for achieving public policy goals beyond investor protection and fostering vibrant capital markets.  Government requirements for salaries, capital structure, and investment are not consistent with a free-market economy.  Such restrictions discourage companies from going public and encourage businesses to seek financing from private markets.  Investors need information to inform their investment decisions, as articulated in Basic v. Levenson.[2]  Disclosure provisions based on other factors neither help investors nor achieve other public policy objectives.

Instead, the SEC should augment its disclosure requirements to better inform investors as to whether issuer repurchases trigger higher payments to senior executives under performance-based compensation schemes, such as by altering earnings per share calculations.

Introduction

Stock buybacks or issuer repurchases are now a political issue and may become the subject of intense political debate.  In March 2020, former Vice President Joe Biden tweeted: “I am calling on every CEO in America to publicly commit now to not buying back their company’s stock over the course of the next year.  As workers face the physical and economic consequences of the coronavirus, our corporate leaders cannot cede responsibility for their employees.”[3] 

The SEC adopted Rule 10b-18 in 1982 as a safe harbor to protect an issuer from the charge that it was manipulating the price of its stock if it repurchased its shares.  The SEC has amended and interpreted Rule 10b-18 from time to time. What began as a technical rule that the SEC intended to address a legitimate problem, has attracted high level criticism and complaints.  Why has such a technical rule engendered such controversy?

Background

Safe Harbor

In 1982, the SEC adopted a non-exclusive “safe harbor” for issuers to repurchase their shares.[4]  The Commission said that it was creating the safe harbor:

from liability for manipulation in connection with purchases by an issuer and certain related persons of the issuer’s common stock. The issuer or other person will not incur liability under the anti-manipulative provisions of Sections 9(a)(2) or 10(b) (and Rule 10b-5 thereunder) if purchases are effected in compliance with the limitations contained in the safe harbor.[5]

The question of whether, and under what circumstances, an issuer should buy its own shares has been around for decades.  When it adopted Rule 10b-18, the SEC stated:

The Commission has considered on several occasions since 1967 the issue of whether to regulate an issuer’s repurchases of its own securities.  The predicates for this effort have been two fold: first, investors and particularly the issuer’s shareholders should be able to rely on a market that is set by independent market forces and not influenced in any manipulative manner by the issuer or persons closely related to the issuer. Second, since the general language of the anti-manipulative provisions of the federal securities laws offers little guidance with respect to the scope of permissible issuer market behavior, certainty with respect to the potential liabilities for issuers engaged in repurchase programs has seemed desirable.

The SEC wanted to allow issuers to repurchase their shares for legitimate business reasons, without running the risk of facing allegations of market manipulation. 

Twenty-one years later, the SEC adopted amendments to Rule 10b-18 which fine-tuned the rule, but did not revisit its original purpose.  In its proposing release, the Commission explained:

Issuers repurchase their securities for many legitimate business reasons.  For example, issuers may repurchase their stock in order to have shares available for dividend reinvestment, stock option and employee stock ownership plans, or to reduce the outstanding capital stock following the cash sale of operating divisions or subsidiaries. Issuers may believe that a repurchase program is preferable to paying dividends as a way of returning capital to shareholders. Issuer repurchases also provide liquidity in the marketplace, which benefits all shareholders.

At the same time, an issuer has a strong interest in the market performance of its securities. Among other things, its securities may be the consideration in an acquisition, or serve as collateral for financing.  The market price also determines the price of offerings of additional securities.  Therefore, at various times, the issuer may have an incentive to manipulate the price of its securities. One way to positively affect the price is to purchase the securities in the open market.  Because repurchases of its securities could affect the market price of an issuer’s stock, this may expose the issuer to claims that the repurchases were made in a manipulative manner even when they were done in a manner not intended to move market prices.[6]

The 2003 Amendments modified the rule and added new disclosure provisions.  Significantly, in its summary of comments, the Commission did not indicate that any commentator objected to the rule itself or asked the SEC to eliminate the rule.  The commentators only raised technical issues, such as whether the revisions should eliminate a “block exception.”[7]

Basic Outlines of the Rule

The SEC intended Rule 10b-18 to minimize the impact of the issuer’s purchases on the market for the shares.  Investors who buy or sell when the issuer is purchasing should not suffer or benefit from the fact that the issuer is in the market at the same time.  Of course, every purchase or sale has some effect on a security’s price; nonetheless, the SEC’s goal was to reduce the impact of the issuer’s purchases as much as possible so as not to upset ordinary market dynamics.

To achieve that goal and to qualify for the non-exclusive safe harbor, Rule 10b-18(b) provides that the issuer must meet four conditions:

  1. The issuer must execute its trades through one broker-dealer;
  2. The broker-dealer must not execute its trades at the opening or before the closing of trading for that day;
  3. The broker-dealer must execute trades at prices that do not exceed the highest independent bid or the last independent transaction price, whichever is higher; and
  4. The total volume of purchases effected by or for the issuer and any affiliated purchasers effected on any single day must not exceed 25% of the average daily trading volume for that security.

Preliminary Note ¶2 of Rule 10b-18 states that “the safe harbor, moreover, is not available for repurchases that, although made in technical compliance with the section, are part of a plan or scheme to evade the federal securities laws.”  By the same token, subsection (d) also provides that:

No presumption shall arise that an issuer or an affiliated purchaser has violated the anti-manipulation provisions of sections 9(a)(2) or 10(b) of the [Exchange] Act or §240.10b-5 under the [Exchange] Act, if the Rule 10b-18 purchases of such issuer or affiliated purchaser do not meet the conditions specified in paragraph (b) or (c) of this section.

The rule has many qualifications and the Division of Trading and Markets has issued numerous FAQs regarding the rule. 

As noted, the 2003 Amendments added new provisions requiring issuers to disclose specific time and volume information about their buy-back activities.  The Commission added Item 703 to Regulation S-K requiring issuers to disclose for each month in which the issuer buys back its securities:

  • Total number of shares (or units) purchased;
  • Average price paid per share (or unit);
  • Total number of shares (or units) purchased as part of publicly announced plans or programs; and
  • Maximum number (or approximate dollar value) of shares (or units) that may yet be purchased under the plans or programs.

The SEC explained that issuers would need to make these disclosures for repurchases of Section 12 registered equity securities, whether the issuer purchased them in open market or private transactions.  Item 703 requires the issuer to make these disclosures on:

  • Form 10–Q – for its last fiscal quarter;
  • Form 10-K – for the fourth quarter of its fiscal year.
  • Form N-CSR (Item 8) – for registered closed-end funds for the semi-annual period.

This disclosure requirement is independent of the Rule 10b–18 safe harbor.[8]

Again, commentators supported the changes, and only disagreed with a specific provision that would have required the issuer to identify the broker-dealer effecting the trades.  The SEC agreed with that objection, but otherwise adopted a detailed tabular disclosure requirement.[9]

These changes were in addition to other executive compensation disclosure requirements.  Subsections of Item 402 of Regulation S-K (17 C.F.R.§229) require issuers to disclose compensation that the issuer pays to certain senior officers, including:

  • (a)(6)(iii) – Definition of “Incentive Plan;”[10]
  • (c) – Summary compensation table;
  • (d) – Grants of plan-based awards;
  • (e) – Narrative disclosure to summary compensation table and grants of plan-based awards table.
  • (f) – Outstanding equity awards at fiscal year-end table;
  • (g) – Options exercises and stock vested table;
  • (h) – Pension benefits;
  • (i) – Nonqualified deferred compensation and other nonqualified deferred compensation plans; and
  • (j) – Potential payments upon termination or change-in-control.

In summary, the SEC designed Rule 10b-18 to minimize the market impact of an issuer’s repurchases conducted within its safe harbor.  In addition, Items 703 and 402 of Regulation S-K require the issuer to disclose information about the buyback program and any related compensation that the issuer pays to senior executives that relate to the issuer’s stock price.

Are Buybacks Good for Investors?

As noted, in recent years, many issuers have repurchased their shares. In his famous Annual Letter to Shareholders, Warren Buffet explains the benefits to shareholders of Berkshire Hathaway’s share repurchases:

Last year we demonstrated our enthusiasm for Berkshire’s spread of properties by repurchasing the equivalent of 80,998 “A” shares, spending $24.7 billion in the process.  That action increased your ownership in all of Berkshire’s businesses by 5.2% without requiring you to so much as touch your wallet.

Following criteria Charlie [Munger] and I have long recommended, we made those purchases because we believed they would both enhance the intrinsic value per share for continuing shareholders and would leave Berkshire with more than ample funds for any opportunities or problems it might encounter.

In no way do we think that Berkshire shares should be repurchased at simply any price.  I emphasize that point because American CEOs have an embarrassing record of devoting more company funds to repurchases when prices have risen than when they have tanked. Our approach is exactly the reverse.

Mr. Buffet then discusses Berkshire Hathaway’s investment in Apple, which itself repurchased its shares:

Berkshire’s investment in Apple vividly illustrates the power of repurchases.  We began buying Apple stock late in 2016 and by early July 2018, owned slightly more than one billion Apple shares (split-adjusted). *** When we finished our purchases in mid-2018, Berkshire’s general account owned 5.2% of Apple.

Our cost for that stake was $36 billion.  Since then, we have both enjoyed regular dividends, averaging about $775 million annually, and have also – in 2020 – pocketed an additional $11 billion by selling a small portion of our position.

Despite that sale – voila! – Berkshire now owns 5.4% of Apple.  That increase was costless to us, coming about because Apple has continuously repurchased its shares, thereby substantially shrinking the number it now has outstanding.

But that’s far from all of the good news.  Because we also repurchased Berkshire shares during the 21⁄2 years, you now indirectly own a full 10% more of Apple’s assets and future earnings than you did in July 2018.

This agreeable dynamic continues. Berkshire has repurchased more shares since yearend and is likely to further reduce its share count in the future. Apple has publicly stated an intention to repurchase its shares as well.  As these reductions occur, Berkshire shareholders will not only own a greater interest in our insurance group and in BNSF and BHE, but will also find their indirect ownership of Apple increasing as well.

The math of repurchases grinds away slowly, but can be powerful over time.  The process offers a simple way for investors to own an ever-expanding portion of exceptional businesses.

And as a sultry Mae West assured us: “Too much of a good thing can be . . . wonderful.”[11]

Mr. Buffet notes that not every issuer repurchase is great for the issuer or its shareholders, but is too diplomatic to point to the repurchases with which he disagrees.  The decisions of whether and when to repurchase shares have been a matter of business judgment, not a legal or public policy concern.  Shareholders are the ultimate judge of whether an issuer’s management was wise – either because it repurchased shares or because it didn’t.

Shareholders also may prefer issue repurchases to dividends for tax reasons.  When a company declares and pays a dividend, the shareholder has no choice as to whether or not to take the dividend and must report the payment as ordinary taxable income.  By comparison, a buyback normally raises the value of the remaining shares but has no immediate tax implications for shareholders who choose not to sell.  Such investors need not recognize income unless they choose to sell their shares.  Moreover, investors who subsequently sell may time their sales to ensure that their profits are subject to capital gains tax rates, rather than ordinary income.[12] 

Recent Concerns

Despite the business case for repurchases and the rules that govern them, some observers have raised serious objections to issuer repurchases.  The authors of one article in the Harvard Business Review state the following:

  • ’Buybacks’ drain on corporate treasuries has been massive. The 465 companies in the S&P 500 Index in January 2019 that were publicly listed between 2009 and 2018 spent, over that decade, $4.3 trillion on buybacks, equal to 52% of net income, and another $3.3 trillion on dividends, an additional 39% of net income.***

  • With the majority of their compensation coming from stock options and stock awards, senior corporate executives have used open-market repurchases to manipulate their companies’ stock prices to their own benefit and that of others who are in the business of timing the buying and selling of publicly listed shares. Buybacks enrich these opportunistic share sellers — investment bankers and hedge-fund managers as well as senior corporate executives — at the expense of employees, as well as continuing shareholders.

  • In contrast to buybacks, dividends provide a yield to all shareholders for, as the name says, holding Excessive dividend payouts, however, can undercut investment in productive capabilities in the same way that buybacks can. Those intent on holding a company’s shares should therefore want it to restrict dividend payments to amounts that do not impair reinvestment in the capabilities necessary to sustain the corporation as a going concern.  With the company plowing back profits into well-managed productive investments, its shareholders should be able to reap capital gains if and when they decide to sell their shares.[13]

In 2018, then-SEC Commissioner Robert J. Jackson, Jr. raised several concerns about stock buybacks.  In particular, he claimed that corporate executives use buybacks to drive up the price of the issuer’s stock and then sell their shares shortly thereafter.  The Commissioner and his staff examined 385 buybacks in the 15 months preceding his remarks.

First, we found that a buyback announcement leads to a big jump in stock price: in the 30 days after the announcements we studied, firms enjoy abnormal returns of more than 2.5%.  That’s unsurprising: when a public company in the United States announces that it thinks the stock is cheap, investors bid up its price.

What did surprise us, however, was how commonplace it is for executives to use buybacks as a chance to cash out.  In half of the buybacks we studied, at least one executive sold shares in the month following the buyback announcement. In fact, twice as many companies have insiders selling in the eight days after a buyback announcement as sell on an ordinary day. So right after the company tells the market that the stock is cheap, executives overwhelmingly decide to sell.

* * * * *

Now, let’s be clear: this trading is not necessarily illegal. But it is troubling, because it is yet another piece of evidence that executives are spending more time on short-term stock trading than long-term value creation.  It’s one thing for a corporate board and top executives to decide that a buyback is the right thing to do with the company’s capital. It’s another for them to use that decision as an opportunity to pocket some cash at the expense of the shareholders they have a duty to protect, the workers they employ, or the communities they serve.[14]

In a 2019 letter responding to an inquiry from U.S. Senator Christopher Van Hollen, Jr. (D MD), Commissioner Jackson stated that further study showed that “when executives unload significant amounts of stock upon announcing a buyback, they often benefit from short-term price pops at the expense of long-term investors.  SEC rules do not address insiders’ incentives to pursue buybacks at the expense of buy-and-hold American investors.”[15]

Commissioner Jackson’s 2019 response concludes:

To be sure, this analysis does not show whether insiders’ sales cause lower long-run returns or whether insiders correctly anticipate that returns will be lower so sell opportunistically.  But from the perspective of ordinary American investors saving for retirement, I cannot see why that distinction should matter. Whether insider sales cause the stock to fall or simply reflect insiders’ view that the buyback won’t add value in the long run, the opportunity to cash out stock-based pay gives executives reason to pursue buybacks that do not produce long-term value.  Those incentives deserve attention from the SEC.[16]

Discussion

In this section, we examine some of the specific objections to Rule 10b-18 and issuer buybacks and discuss whether those criticisms hold water.

Objection: Rule 10b-18 is Inconsistent with the SEC’s Mandate to Eliminate Manipulation from the Securities Markets.

Some criticize the SEC for what they believe is an agenda of favoring corporate management at the expense of other aspects of society and using the federal securities laws as a means to that end.  For example, Professor Lazonick states that Rule 10b-18 was a departure from the anti-fraud mission of the SEC that Congress established when it enacted the Exchange Act. 

The rule was a major departure from the agency’s original mandate, laid out in the Securities Exchange Act in 1934.  The act was a reaction to a host of unscrupulous activities that had fueled speculation in the Roaring ’20s, leading to the stock market crash of 1929 and the Great Depression.  To prevent such shenanigans, the act gave the SEC broad powers to issue rules and regulations.

During the Reagan years, the SEC began to roll back those rules.  The commission’s chairman from 1981 to 1987 was John Shad, a former vice chairman of E.F. Hutton and the first Wall Street insider to lead the commission in 50 years. He believed that the deregulation of securities markets would channel savings into economic investments more efficiently and that the isolated cases of fraud and manipulation that might go undetected did not justify onerous disclosure requirements for companies. The SEC’s adoption of Rule 10b-18 reflected that point of view.[17]

Response.

I disagree with Professor Lazonick’s characterization of Chairman Shad, the Commission at that time, and of Rule 10b-18.  During Chairman Shad’s tenure, the SEC:

  • brought some of the biggest insider trading cases in the history of the Commission; [18]
  • supported legislation that permitted the SEC to seek civil penalties against those who traded on inside information; [19]
  • oversaw the creation of the EDGAR system to enhance access to public companies’ SEC filings; [20] and
  • directed the SEC to combine Securities Act of 1933 (Securities Act) and Exchange Act disclosures into an integrated system[21].

In short it is an unfair caricature of John Shad, and the SEC that he chaired, to claim that he ignored minor amounts of fraud in exchange for greater market efficiency.  Suggesting that Rule 10b-18 was part and parcel of an SEC that tolerated fraud simply does not square with the facts.[22]

Improper Use of Corporate Resources.

Some observers believe that management should use corporate profits for purposes other than issuer repurchases.  The authors of one study suggest that public companies should spend more of their profits by increasing rank and file employees’ compensation, rather than by buying back their stock: “U.S. publicly traded companies across all industries spent almost 60% (58.6%) of their profits on buybacks between 2015 and 2017, leaving fewer funds (relative to growth of profits) for other productive purposes, such as corporate investment, job creation, and raising wages.”[23] 

In particular, the study identifies companies that could raise employees’ compensation above minimum wage, rather than spending money on buybacks:

  • The restaurant industry spent more on buybacks than it reported in profits between 2015 and 2017, which suggests that these companies are borrowing or are using other cash reserves to fund buybacks. The five companies spending the most on buybacks each year are McDonald’s, YUM Brands, Starbucks, Restaurant Brands International, and Domino’s Pizza. These companies could pay the median worker an average of 25% more each year if those corporate funds were spent on wages instead.
  • Starbucks could give each worker at least $7,119 more a year; McDonald’s could raise pay by almost $3,853; and Domino’s Pizza and Restaurant Brands International could pay each of their workers over $2,000 more annually.
  • The top spenders on buybacks in retail are Home Depot, Walmart, CVS, Lowe’s, and Target. On average, these companies spent 87% of their net profits on buybacks, and they could pay the median worker in their respective companies an average of 56% more each year. The average ratio of CEO pay to median worker compensation among these companies is 587 to 1 — with average CEO total compensation at over $13 million.[24]

Another article focused on Home Depot:

On a conference call with investors in February 2018, [Craig Menear, the chairman and CEO of Home Depot] and his team mentioned their “plan to repurchase approximately $4 billion of outstanding shares during the year.”  The next day, he sold 113,687 shares, netting $18 million. The following day, he was granted 38,689 new shares, and promptly unloaded 24,286 shares for a profit of $4.5 million. Though Menear’s stated compensation in SEC filings was $11.4 million for 2018, stock sales helped him earn an additional $30 million for the year.

By contrast, the median worker pay at Home Depot is $23,000 a year.  If the money spent on buybacks had been used to boost salaries, the Roosevelt Institute and the National Employment Law Project calculated, each worker would have made an additional $18,000 a year.[25]

Some observers complain about income equality in American society and point to buybacks as one manifestation of that inequality.  Critics who believe that American corporations disproportionately benefit the wealthy in society also may object to what they believe to be:

  • unfairly low minimum wage laws;
  • the failures of corporations to share profits with employees and communities;
  • the failures of corporations to reinvest in their businesses; and
  • the failures of legislatures and corporations alike to protect American jobs.

For example, one article reported that in 2018, Harley-Davidson announced a “nearly $700 million stock buyback plan” shortly after announcing that it would close a plant in Kansas City.[26]  Further, Tung and Milani note that “given that women and people of color are overrepresented in the workforces of these three industries, poor job quality combined with high buyback activity deepen existing gender and racial income disparities.”[27]

Response.

Misuse of corporate resources objections fall into two categories:

  • issuer repurchases divert the issuer’s resources from expenditures that would benefit workers and their companies; and
  • that buybacks create perverse incentives for senior executives to use stock buybacks to trigger additional compensation.

We discuss each of these issues below.

Diversion of Resources/Allocation of Capital.

Those who believe that Rule 10b-18 prevents issuers from raising wages or making other investments, in effect, are suggesting that the SEC should regulate capital structures of corporations.  That would be a radical departure from both the law and the spirit of the federal securities laws.  It also would be a policy mistake.

It is axiomatic that Congress employed a disclosure model of regulation when it enacted the Securities Act and the Exchange Act.  Eschewing merit regulation, Congress embraced the philosophy of Louis Brandeis that “sunlight is said to be the best of disinfectants; electric light the most efficient policeman.”[28]  The Securities Act and the Exchange Act prohibit manipulative or fraudulent behavior for public and private offerings, but they do not prescribe how corporations must operate or require them to have a specific corporate structure.  Shortly after Congress enacted the Securities Act, William O. Douglas and George Bates described this unique structure:

As a matter of fact there are but few of the transactions investigated by the Senate Committee on Banking and Currency which the Securities Act would have controlled.  There is nothing in the Act which would control the speculative craze of the American public, or which would eliminate wholly unsound capital structures. There is nothing in the Act which would prevent a tyrannical management from playing wide and loose with scattered minorities, or which would prevent a new pyramiding of holding companies violative of the public interest and all canons of sound finance. All the Act pretends to do is to require the “truth about securities” at the time of issue, and to impose a penalty for failure to tell the truth. Once it is told, the matter is left to the investor.[29]

Congress only granted the SEC authority to regulate capital structures under very limited circumstances:

  • The Public Utility Holding Company Act of 1935 (PUHCA). That legislation empowered the SEC to restructure the entire public utility industry in the wake of the Insull scandal, the Enron of its day.[30]  
  • The Trust Indenture Act of 1939 (TIA), among other things, prohibits sale of certain debt instruments “unless a formal agreement between the issuer of bonds and the bondholder, known as the trust indenture, conforms to the standards of this Act.”[31]
  • The Investment Company Act of 1940 (Company Act) imposes limitations on structures of investment companies. For example, the Section 18(f) of the Company Act makes it

unlawful for any registered open-end company to issue any class of senior security or to sell any senior security of which it is the issuer … Provided, That immediately after any such borrowing there is an asset coverage of at least 300 per centum for all borrowings of such registered company….

The SEC has issued various exemptive rules, such as Rule 18f-4, that permits funds to use derivative securities without running afoul of the prohibitions in Section 18.[32]

Congress has not granted the SEC broad authority to establish capital structures and only has granted narrow authority in limited circumstances.  Indeed, Congress narrowed that authority as it gained experience with the results of such efforts. 

Finally, when the SEC attempted to assert its authority over publicly-traded companies’ capital structures, the Court of Appeals for the District of Columbia ruled in 1990 that the SEC lacked authority to do so.  In 1988, the SEC had adopted Rule 19c-4:

barring national securities exchanges and national securities associations, together known as self-regulatory organizations (SROs), from listing stock of a corporation that takes any corporate action with the effect of nullifying, restricting or disparately reducing the per share voting rights of [existing common stockholders].” *** Because the rule directly controls the substantive allocation of powers among classes of shareholders, we find it in excess of the Commission’s authority under Sec. 19 of the… Exchange Act …” 

The court rejected the SEC’s assertion that it had exceptionally broad discretion under Section 19 of the Exchange Act.  The court stated that: “if Rule 19c-4 were validated on such broad grounds, the Commission would be able to establish a federal corporate law by using access to national capital markets as its enforcement mechanism.”  Although the court left open the possibility that other statutory provisions would “provide authority for promulgating these or other rules,” the court declined to search for such grounds.[33]

Moreover, Congress has declined to grant the SEC authority to regulate the capital structure of public companies despite ample opportunities.  Congress made two extensive revisions to the federal securities laws in the wake of major scandals.  In 2002, Congress enacted the Sarbanes-Oxley Act in response to the Enron and WorldCom scandals.[34]  That legislation “mandated a number of reforms to enhance corporate responsibility, enhance financial disclosures and combat corporate and accounting fraud, and created the ‘Public Company Accounting Oversight Board,’ … to oversee the activities of the auditing profession.”[35] After the Great Recession of 2008, Congress enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd Frank Act).[36] “ That act “set out to reshape the U.S. financial regulatory system in a number of areas including but not limited to consumer protection, trading restrictions, credit ratings, regulation of financial products, corporate governance and disclosure, and transparency.”[37]  Despite the breadth and scope of both statutes, neither authorized or directed the SEC to regulate the capital structure of public companies.  Accordingly, it is unlikely that any effort to do so directly would withstand judicial scrutiny.

It would not be wise for Congress to grant such authority to the SEC if Congress’s goal is to raise workers’ wages or otherwise seek to address income disparity in the United States.[38]  To achieve the goals that the critics of Rule 10b-18 set forth, the federal government would need to dictate, for each public issuer:

  • capital structure, including debt/equity and shares outstanding;
  • size of the workforce and its compensation;
  • investments in research and development, and
  • executive compensation.

It is difficult to imagine that Congress or the SEC could develop a regulatory system for managing capital structures that would ensure that American businesses could adapt to an ever-changing marketplace.  By eliminating Rule 10b-18, but more ominously, seeking to regulate public companies’ capital structures and expenditures, the federal government would impose a straightjacket on every public issuer of securities.

The market is a harsh judge of what management does or does not do.  An issuer needs cash to repurchase its shares.  If the issuer has cash in the bank, it may use those funds to repurchase shares.  If it does not, it will need to borrow the money by selling debt securities or by borrowing from a bank.  There are opportunity costs for whatever course of action an issuer takes or does not take. 

Decisions about how to use an issuer’s resources are the responsibility of management, as overseen by its board of directors.  The issuer’s stock price will fall if the issuer:

  • hoards cash for no reason;
  • uses too much cash for risky endeavors;
  • fails to plan for the future and invest in new technology;
  • uses too much money to pay for the buyback (whether from reserves or from loans) and then lacks resources for other initiatives; or
  • hires too many or too few employees at salaries that diverge from market rates.

These are among the fundamental decisions that corporate management must make; failure to choose well will jeopardize not only the jobs of the senior executives, but the future of the company as a whole.  Markets, not government, are the best measure of whether management’s decisions were wise.

Manipulating Measures of Success to Trigger Compensation.

Some critics suggest that issuer buybacks increase stock prices and allow executives to sell their shares at higher prices.  The author looked at disclosures for Home Depot and Starbucks, examples noted above.  Home Depot, which had a significant stock buyback program,[39] uses a multitude of measures for awarding compensation[40].  These include quantitative standards such as sales, operating profit, and inventory turns.  To discourage executives from focusing on quarter-to-quarter profits, Home Depot uses a combination of performance shares, performance-based restrictive stock, and stock options.  Some incentives have caps to avoid windfalls from unexpectedly high revenues.  Starbucks has similar provisions.[41]  In summary, the compensation plans weigh a variety of factors and compensate executives based on a range of performance measures.  Executive compensation depends on many factors, not just one measure, such as earnings per share.

It is important to remember that the conditions of Rule 10b-18 seek to minimize the market impact of the repurchases.  Further, investors who sell during the buyback period have no idea whether the issuer or another investor is buying their shares.  Most long sellers will not object if the price of the stock increases at the time of their sale. 

It is easy to criticize executives who sell large blocks of stock and to suggest that they have either manipulated the price of the stock to rise at the time that they sell or that they are trading on inside information.  Although it is impossible to prove a negative, the circumstances of executives’ stock sales may be complex:

  • Senior executives may have accumulated extremely large positions in the issuer’s securities. It is only sensible money management for them to sell some of their shares in that issuer and to diversify their investments.
  • Officers, directors, and 10% shareholders who buy and sell (or sell and buy) that issuer’s securities must avoid running afoul of Section 16(b) of the Exchange Act. Although not a violation of the securities laws, persons in those categories who trade too soon are subject to a lawsuit for disgorgement of any profits.
  • Senior managers will not buy or sell shares during certain “blackout periods.”
    • To avoid trading on inside information or appearing to do so, senior managers will not buy or sell shares in the issuer in the weeks before the issuer announces quarterly earnings or other material corporate events. It would be more problematic for a senior manager to sell their shares just prior to the issuer’s announcement of material news, than after. For this reason, most compliance departments only will allow their employees to trade shares in the companies for which they work during specific windows after major releases.[42]
    • Section 306(a) of the Sarbanes Oxley Act of 2002 and Regulation BTR prohibit directors and executive officers from selling the issuer’s shares during a pension black out period.

Finally, as noted, many corporate executives sell in accordance with Rule 10b5-1 plans.  Such plans permit investors to defend against a claim of insider trading by establishing a plan to sell the issuer’s shares on an automatic basis.[43]

Some critics claim that linking executive compensation to earnings per share (EPS) and share prices allow management to “move the goal posts” to suit their needs.  For example, an issuer that buys back its shares could raise the earnings per share to a level that triggers additional executive compensation.  Because a buyback often raises the issuer’s stock price, management could drive the issuer’s stock price up sufficiently to trigger additional compensation.  A 2015 Reuters study observed the following:

255 of [S&P 500] companies reward executives in part by using EPS, while another 28 use other per-share metrics that can be influenced by share buybacks.

In addition, 303 also use total shareholder return, essentially a company’s share price appreciation plus dividends, and 169 companies use both EPS and total shareholder return to help determine pay.

EPS and share-price metrics underpin much of the compensation of some of the highest-paid CEOs, including those at Walt Disney Co., Viacom Inc., 21st Century Fox Inc., Target Corp. and Cisco Systems Inc.

Fewer than 20 of the S&P 500 companies disclose in their proxies whether they exclude the impact of buybacks on per-share metrics that determine executive pay.[44]

Heitor Almeida, a professor of finance with the College of Business at the University of Illinois, says EPS “is not an appropriate target, it’s too easy to manipulate.”[45]

Others disagree and dismiss the idea of management manipulating EPS for their personal benefit as a myth:

Myth #4: Management teams only repurchase stock in an attempt to inflate EPS and meet incentive compensation targets.

Reality: Executives whose compensation depends on EPS did not allocate a greater proportion of total cash spending to buybacks in 2018 than companies where management pay was not linked to EPS.[46]

Indeed, among the S&P 500, the reverse is true.[47]

Congress should not use Specialized Securities Disclosure Provisions to Achieve other Policy Goals.

When Congress tries to use the federal securities laws to address social problems in different policy arenas, the outcomes are not satisfactory – either in achieving congressional goals or from the standpoint of investor protection.  In the Dodd Frank Act, Congress included three provisions that it intended to address policy concerns that it deemed important.  The provisions directed the SEC to undertake rulemakings that had nothing to do with the SEC’s core mission.  As a consequence, the SEC devoted an enormous amount of resources to discharge those responsibilities, distracting the SEC from its core mission.  The three provisions of the Dodd Frank Act at issue are:

  • Section 1502 – Conflict Minerals – Requiring issuers to disclose information about certain raw materials that they obtain from the Democratic Republic of the Congo;[48]
  • Section 1503 – Reporting Requirements Regarding Coal or Other Mine Safety – Requiring issuers to disclose information about mine safety violations;[49]
  • Section 1504 – Resource ExtractionRequires issuers involved with resource extraction to disclose information about payments to foreign governments.[50]

Congress enacted these provisions with good intentions, but the disclosure requirements related to other public policy concerns.  Congress did not give the SEC the discretion not to adopt these rules.  The rulemaking for Section 1503 was apparently uneventful, but dealt with issues that are not within the SEC’s expertise.  For example, it does not appear that Section 1503 permits the Commission to consider whether an issuer’s mine is material to the issuer’s financial position.  Section 1503 and its rules require an issuer with a miniscule mining operation to make these disclosures whether or not the mining operation had any meaningful implication for investors.  If Congress has continuing concerns about mine safety, it should examine the mine safety laws, not amend the securities laws.

The rulemakings for sections 1502 (conflict minerals) and 1504 (resource extraction) were administrative nightmares for the SEC.  There were conflicting views as to whether Section 1502 helped or hurt the people of the Democratic Republic of Congo.[51]  These provisions drained the SEC’s resources and forced disclosures on issues that have nothing to do with investing.

Mary Jo White, SEC Chair at the time, observed about these Dodd Frank Act mandates:

[Some] mandates, which invoke the Commission’s mandatory disclosure powers, seem more directed at exerting societal pressure on companies to change behavior, rather than to disclose financial information that primarily informs investment decisions.

That is not to say that the goals of such mandates are not laudable.  Indeed, most are.  Seeking to improve safety in mines for workers or to end horrible human rights atrocities in the Democratic Republic of the Congo are compelling objectives, which, as a citizen, I wholeheartedly share.

But, as the Chair of the SEC, I must question, as a policy matter, using the federal securities laws and the SEC’s powers of mandatory disclosure to accomplish these goals.[52] 

Congress should not force the SEC to meddle in policy arenas for which it is not well-equipped and divert it from its core mission.  SEC disclosure requirements should focus on the standard that the Supreme Court enunciated in Basic v. Levinson: “materiality depends on the significance the reasonable investor would place on the withheld or misrepresented information.”[53]  Congress’s attempts to use the securities laws for unrelated policy objectives have not been successful.  Congress should not repeat that error.

Recommendation

When reviewing executive compensation and issuer repurchase disclosures, it is difficult to determine whether an issuer repurchase program altered earnings or price per share, thereby triggering any executive compensation.  SEC rules require issuers to explain the compensation plans in detail and to describe their repurchase programs.  But there is no requirement that issuers explain any nexus between repurchases and executive compensation.  Further, the author could not determine whether an issuer was reporting its EPS before or after the repurchase programs and whether or how the repurchase affected the EPS calculation.

Accordingly, I suggest that the SEC amend Regulation S-K (17 C.F.R. § 229.402(d), instruction (7)) as follows:

  1. Options, SARs and similar option-like instruments granted in connection with a repricing transaction or other material modification shall be reported in this Table.However, the disclosure required by this Table does not apply to any repricing that occurs through a pre-existing formula or mechanism in the plan or award that results in the periodic adjustment of the option or SAR exercise or base price, an antidilution provision in a plan or award, or a recapitalization or similar transaction equally affecting all holders of the class of securities underlying the options or SARs. Explain any repricing that occurred to options, SARS, and similar-option-like instruments. Such explanation shall include answers to the following questions: 

    i. Did the issuer (or its affiliate) undertake an issuer repurchase of securities that resulted in a change in the calculation of the issuer’s earnings per share (or similar calculation)? and

    ii. Did such change in calculation cause the issuer to pay a different amount of compensation to the persons specified in Item 402(a)(3) than it otherwise would have, had the issuer (or its affiliate) not repurchased the securities?

    If so, specify the repurchase transaction(s) and the resulting changes to compensation, including the amounts, however paid or allocated.

    If the answer to either of the prior questions is yes, identify the calculation and report the amount of earnings per share (or other calculation) before and after the issuer’s repurchase and explain the reason for the adjustment. [Deletions additions]

Such questions would allow shareholders to judge for themselves if management altered the capital structure in a way that resulted in a benefit to those managers.  The securities laws trust investors to use good judgment when they have access to material information.  These circumstances are no different from other matters of corporate governance.

Conclusion

The federal securities laws and the SEC’s administration of those laws have fostered capital markets that are the envy of the world.  According to SIFMA, for 2019:

  • Equities: “U.S. equity markets represent 39.4% of the $95.0 trillion in global equity market cap, or $37.5 trillion; this is 3.9x the next largest market, the EU (excluding the U.K.).”
  • Fixed Income: “U.S. fixed income markets comprise 38.9% of the $105.9 trillion securities outstanding across the globe, or $41.2 trillion; this is 1.9x the next largest market, the EU (excluding the U.K.).”[54]

In my view, it would not be wise to repeal Rule 10b-18 with the purpose of reintroducing the uncertainty that caused issuers not to repurchase their shares.  Rule 10b-18 creates legal certainty that permits issuers to repurchase their shares without fear of an SEC investigation or private lawsuit.  Because the federal securities laws define fraud and manipulation broadly, it was previously risky for an issuer to repurchase its shares even for the most legitimate of reasons.  Issuers wishing to avoid controversy would not undertake repurchases for fear that the SEC or a private litigant would charge the issuer with market manipulation.  Suggesting that the SEC should withdraw the rule and reestablish that legal uncertainty is not a sensible way to make policy.  Besides adding legal uncertainty, a repeal of Rule 10b-18 creates the likelihood that issuers will declare dividends to return cash to shareholders, which is a less efficient way to reward existing shareholders because of the higher tax burden.  If Congress or the SEC want to prohibit or curtail issuer repurchases, they should do so deliberately and not by reintroducing a fog of legal ambiguity that discourages legitimate and questionable activity alike.[55] 

Further, Congress or the SEC should not repeal Rule 10b-18 if their real objective is some other policy goal.  As demonstrated above, repeal of Rule 10b-18 will do nothing to address the concerns of some that executive compensation is excessive.  Using the federal securities laws to try to achieve other public policy goals does not work well and distracts the SEC from its primary mission.  As noted, the SEC has no special expertise in conflict minerals, mine safety, or resource extraction.  Congress has numerous federal agencies at its disposal (and can create new ones) that do have relevant expertise in these or any other policy topics.

If the opponents of Rule 10b-18 believe that executive compensation is too high or that public companies are not investing for the future, Congress and the SEC should have that public policy debate directly, not through the backdoor of Rule 10b-18.  Similarly, if Congress thinks that workers need a pay raise, it should debate raising the federal minimum wage and weigh the relevant economic arguments.[56]  Those who favor such changes to the operation of public companies must appreciate that the federal government would need to micromanage the operations of public companies to an unprecedented degree.  If Congress were to embrace such a policy, many issuers would go private, or remain private longer.[57]  Preventing the public from investing in a broader range of issuers only will contribute to widening the wealth gap in America, not narrowing it.[58] 

Additional disclosure, not the elimination of Rule 10b-18 or other policy mandates, would give the public greater insight into stock repurchases and senior managers’ compensation at public companies.  The recommendation above would help investors assess whether management is using repurchases to enrich itself.  More sunlight, not more prescriptive measures, is the better approach.


[1] © 2021 Stuart J. Kaswell, Esq., who has granted permission to the ABA to publish this article in accordance with the ABA’s release, a copy of which is incorporated by reference. Stuart Kaswell is an experienced financial services lawyer. He has worked at the Securities and Exchange Commission, as securities counsel to the Committee on Energy and Commerce of the U.S. House of Representatives (when it had securities jurisdiction), and has been a partner at two law firms and general counsel of two financial trade associations. Mr. Kaswell wishes to thank the following persons for reviewing drafts of this article: Larry E. Bergmann, Esq. and James Brigagliano, Esq., as well as his son, Noah Kaswell, who works in private equity.  All of the opinions and recommendations in this article are the author’s alone and do not reflect the views of any reviewer or of any current or prior clients or employers. Any errors are the author’s alone.

[2] Basic Inc. et al v. Levinson et al, 485 U.S. 224 (1988).

[3] Biden [@JoeBiden]. Mar. 20, 2020. [Tweet]. Twitter.

[4] Release No. 33-6434 (Nov. 17, 1982); 47 FR 53333 (Nov. 26, 1982) (footnote omitted).  This article refers to Section 9(a)(2) and Section 10(b) of the Exchange Act and Rule 10b-5 thereunder as the “anti-manipulation” provisions, rather than repeating these citations below.  Rule 10b-18 does not provide a safe harbor for other types of securities frauds, such as insider trading.

[5] Id.

[6] Release 33-8160 (Dec. 10, 2002); 67 FR 77594 (Dec. 18, 2002) (footnote omitted).

[7] Release 33-8335 (Nov. 10, 2003); 68 FR 64952 (Nov. 1, 2003) (2003 Adopting Release).

[8] 2003 Adopting Release at 64962 (citation omitted).  I also have deleted references to forms that the SEC subsequently abolished.

[9] Id. at 64961-2.

[10]  17 CFR § 229.402(a)(6)(iii) provides, in part, that “the term incentive plan means any plan providing compensation intended to serve as incentive for performance to occur over a specified period, whether such performance is measured by reference to financial performance of the registrant or an affiliate, the registrant’s stock price, or any other performance measure.”

[11] Warren E. Buffet, Letter to Berkshire Hathaway Shareholders for 2020, Feb. 27, 2021.

[12] CFI, Dividend vs Share Buyback/Repurchase Enhance yield or boost EPS?

[13] Lazonick, Sakinç, and Hopkins, Why Stock Buybacks are Dangerous for the Economy, Harvard Business Review, Jan. 7, 2020.  See also Lazonick, Profits Without Prosperity, Harvard Business Review, Sept. 2014.

[14] Remarks of the Honorable Robert J. Jackson, Jr. Commissioner, Stock Buybacks and Corporate Cashouts, Remarks to the Center for American Progress, June 11, 2018.

[15] Letter from the Honorable Robert J. Jackson, Jr. Commissioner, SEC, to the Honorable Christopher Van Hollen, U.S. Senate, March 6, 2019, at 2.

[16] Id at 5.

[17] Lazonick, Profits Without Prosperity, Harvard Business Review, Sept. 2014 [emphasis added].  Professor Laznick writes frequently on this topic.

[18] “During his tenure, Mr. Shad vowed that the SEC would come down on insider trading with “hobnail boots,” and the agency’s staff presented him with an inscribed pair after its successful prosecutions.” Vise, Former SEC Chief John Shad Dies, Washington Post, July 9, 1994.

[19] Statement of the Honorable John S.R. Shad, Chairman, SEC, et. al, as reported in Hearing before the Subcommittee on Telecommunications, Consumer Protection, and Finance of the Committee on Energy & Commerce, U.S. House of Representatives, on H.R. 559, Apr. 13, 1983, Serial No. 98-33, Ninety-Eighth Congress, First Session, at 5. 

[20] e.g., Hearing Before the Subcommittee on Oversight and Investigations, Committee on Energy & Commerce, U.S. House of Representatives, Mar. 14, 1985, Serial No. 99-23, 99th Cong. 1st. Sess.

[21] Statement of the Honorable John S.R. Shad, Chairman, SEC, to the Subcommittee on Securities of the Senate Committee on Banking, Housing and Urban Affairs, U.S. Senate, Mar. 25, 1983, at 46.  See also discussion at 46-49.

[22] Regardless of one’s views of Chairman Shad, it is noteworthy that Congress subsequently amended each of the federal securities laws to ensure that the Commission balances protective measures with market efficiency.  In the National Securities Markets Improvements Act of 1996, Congress added the following language to every one of the federal securities laws:

CONSIDERATION OF PROMOTION OF EFFICIENCY, COMPETITION, AND CAPITAL FORMATION — Whenever pursuant to this title the Commission is engaged in rulemaking, or in the review of a rule of a self-regulatory organization, and is required to consider or determine whether an action is necessary or appropriate in the public interest, the Commission shall also consider, in addition to the protection of investors, whether the action will promote efficiency, competition, and capital formation. 

Pub. L No. 104-290, Oct. 11, 1996, Section 6.

[23] Tung and Milani, Curbing Stock Buybacks: A Crucial Step to Raising Worker Pay and Reducing Inequality, Roosevelt Institute, July 2018, at 7 (Roosevelt Institute Study).  See also Stewart, Stock buybacks, explained, Vox, Aug. 5, 2018.

[24] Id. at 8.

[25] Useem, The Stock-Buyback Swindle, The Atlantic, August 2019.

[26] Stewart, Harley-Davidson took its tax cut, closed a factory, and rewarded shareholders, Vox, May 22, 2018.  However, the Harley-Davidson plant closure is more complicated than just shuttering a plant after a stock buyback.  Harley-Davidson shifted some production to York, PA, but also to Bangkok, Thailand.  Harley-Davidson identified several reasons for company’s decision, such as high Asian tariffs on motorcycles made in the US and declining domestic sales of motorcycles. Union representatives objected to President Trump’s corporate tax cuts that benefited Harley-Davidson, while laying off workers in Kansas City, MO.  See Barrett, In Washington, union rips Harley-Davidson for closing Kansas City plant while opening in Thailand, Milwaukee Journal Sentinel, May 10, 2018.  In addition, in March 2018, President Trump imposed a 25% tariff on steel and a 10% tariff on aluminum imported from the European Union.  The EU responded by increasing the tariffs on U.S. made motorcycles from 6% to 31%.  Harley-Davidson shifted production to Thailand to avoid the tariff increase and to remain competitive.  See Jones, Trump’s Tariffs Have Wiped $1.4 Billion Off Of Harley-Davidson’s Market Cap, Forbes, Sept. 30, 2019.

Harley-Davidson’s 2018 Form 10-K at Part II, Item 5, indicates that between October 1 and December 31, 2018, the company repurchased approximately 4.9 million shares with an average price of $40/share.  The Form 10-K further notes:

In February 2016, the Company’s Board of Directors authorized the Company to repurchase up to 20.0 million shares of its common stock with no dollar limit or expiration date. In February 2018, the Company’s Board of Directors authorized the Company to repurchase up to 15.0 million additional shares of its common stock with no dollar limit or expiration date. As of December 31, 2018, 16.4 million shares remained under these authorizations.

Harley-Davidson subsequently increased its dividend in March 2020 and its board authorized an additional stock buyback program of up to 10 million shares.  MarketWatch, Feb. 19, 2020.  As noted, issuers that increase dividends achieve a goal similar to buybacks, but they may cause their shareholders to pay more taxes.

[27]Curbing Stock Buybacks, supra,. at 9.  The report also posits that buybacks benefit short-term oriented shareholder, rather than long-term investors. Id. at 16.

[28] Brandeis, Other People’s Money and How the Bankers Use It, Chapter V: What Publicity Can Do (1914).

[29] Douglas and Bates, The Federal Securities Act of 1933, Yale Law Journal, Vol. XLII, No. 2, Dec. 1933, available on the website of the SEC Historical Society. [emphasis added.]

[30] According to one account:

[PUHCA] was the most radical reform measure of the Roosevelt administration.  To deal with the sprawl and inefficiency of public utility empires, such as that of Samul Insull, Section 11, the controversial ‘death sentence” provision of that act, empowered the SEC to limit each holding company “to a single integrated public-utility system” by compelling divestiture of most geographically dispersed subsidiaries.

Seligman, The Transformation of Wall Street (1982), at 122.  In subsequent years, Congress limited the scope of PUHCA in several bill that increased competition in the electric generation industry.  Ultimately, Congress repealed PUHCA in the Energy Policy Act of 2005.  That legislation repealed the “SEC’s authority to oversee mergers and other transactions of public utility holding companies.”  At the same time, Congress enacted the Public Utility Holding Company Act of 2005.  That legislation granted new authority to the Federal Energy Regulatory Authority [FERC] to review utilities’ books and records.  “However, unlike its predecessor, PUHCA 2005 does not impose any of the substantive restrictions that effectively barred many entities from ownership of public utilities.” Congressional Research Service, The Repeal of the Public Utility Holding Company Act of 1935 (PUHCA 1935) and Its Impact on Electric and Gas Utilities, Nov. 20, 2006, at 1.  FERC oversees certain aspects of utilities’ operations, such as issuance of securities and assumptions of debt. 18 CFR § 34 et seq.  Nonetheless, Congress significantly curtailed federal restrictions on utility mergers and combinations.

[31] SEC, The Laws That Govern the Securities Industry (Description of the TIA). Section 302 notes that many bond indentures did not make it practicable for bond holders to protect their rights. For example, Section 302(a)(1) of the TIA justified the need for legislation, in part, because in many circumstances:

[T]he obligor fail[ed] to provide a trustee to protect and enforce the rights and to represent the interests of such investors, notwithstanding the fact that (A) individual action by such investors for the purpose of protecting and enforcing their rights is rendered impracticable by reason of the disproportionate expense of taking such action, and (B) concerted action by such investors in their common interest through representatives of their own selection is impeded by reason of the wide dispersion of such investors through many States, and by reason of the fact that information as to the names and addresses of such investors generally is not available to such investors….

Congress amended the TIA in 1990.  The amendments allowed trust indentures to include the necessary provisions by incorporation. P. L. No 101-550.  The author provided legal assistance on this legislation during his time as a Hill staff member.

[32] Release IC-34084 (Nov. 2, 2020); 85 FR 83162 (Dec. 21, 2020).

[33] The Business Roundtable, Petitioner, v. Securities and Exchange Commission, Respondent, 905 F.2d 406 (D.C. Cir. 1990), 905 F 2d. 406 (D.C. Cir. 1990).  See also, Bainbridge, The Scope of the SEC’s Authority Over Shareholder Voting Rights, May 2007, UCLA School of Law Research Paper No. 07-16, available at SSRN: https://ssrn.com/abstract=985707 or http://dx.doi.org/10.2139/ssrn.985707.  Bainbridge states:

Having once entered the field of corporate governance regulation, the SEC would have been hard-pressed to justify stopping with dual class stock. Creeping federalization of corporate law was a plausible outcome. The D.C. Circuit quite properly foreclosed this possibility. The SEC therefore must continue respecting the line drawn by Business Roundtable.

[34] Public Law No: 107-204.

[35] SEC, Sarbanes-Oxley, The Laws That Govern the Securities Industry.

[36] Public Law No: 111-203.

[37] SEC,  Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, The Laws That Govern the Securities Industry.

[38] Some reports indicate that the CEO compensation is rising out of proportion to the compensation of rank-and-file workers.  e.g., in 2019, the Economic Policy Institute observed that “CEO compensation is very high relative to typical worker compensation (by a ratio of 278-to-1 or 221-to-1). In contrast, the CEO-to-typical-worker compensation ratio (options realized) was 20-to-1 in 1965 and 58-to-1 in 1989.” Mishel and Wolfe, CEO Compensation has grown 940% since 1978.  On the other hand, Congressional Budget Office data show relatively stable income distributions between 1997 and 2017, especially after transfers and taxes.

[39] Home Depot Form 10-K for the fiscal year ended Feb. 3, 2019, at 19.

[40] Home Depot Definitive Schedule Form 14A, Proxy Statement for Fiscal Year 2018, at 32.

[41] Starbucks, Form 10-K for the Fiscal Year Ended Sept. 29, 2019, at page 18; Starbucks Form 14A, Definitive Schedule Form 14A Proxy Statement for fiscal year ended Sept. 27, 2020.

[42] See discussion of then-Commissioner Jackson’s views supra at text accompanying note 14.  It is unclear what -Commissioner Jackson means by selling on an “ordinary day.”  Public companies issue quarterly earning statements and must file Form 8-K for any current, material event.  Selling eight days or months after the issuer announces a buyback is an indication that the market had ample time to digest the news of the issuer’s buyback announcement before the senior manager sold their shares.

[43] Some critics believe that Rule 10b5-1 offers overly broad protection.  For example, they assert that some plans allow persons selling too much authority to alter the plans.  By granting the sellers too much flexibility, the plans eliminate the automatic nature of the stock sales, which otherwise should insulate the sellers from the charge that they traded on inside information.  Shortly before he left office, SEC Chairman Jay Clayton testified at a Senate hearing: “for senior executive officers using 10b5-1 plans to sell stock, I do believe that a cooling-off period from the time that the plan is put in place or is materially changed, until the first transaction, is appropriate.” Kiernan, SEC Chairman Urges Corporate Insiders to Avoid Quick Stock Sales, Wall Street Journal, Nov. 17, 2020.

[44] Brettell, Gaffen, and Rohde, Stock buybacks enrich bosses even when business sags, Reuters Investigates, Part 2, Dec. 10, 2015.

[45] Id.

[46] Kostin and Hunter, Debunking buyback myths, Goldman Sachs Global Investment Research, Goldman Sachs and Co. L.L.C., Issue 77, Apr. 11, 2019, at 4. 

[47] Kostin and Hunter further explain:

The 247 companies in the S&P 500 with incentive compensation programs linked to earnings per share—a metric that would benefit from accretive share buybacks—actually spent a smaller share (28%) of their total cash outlays on repurchasing stock compared with the 253 firms without a performance metric linked to EPS (31%).  Moreover, the 49% of S&P 500 firms with EPS-linked compensation accounted for just 45% of total 2018 buybacks ($362 billion). We also found no relationship between how management teams with compensation incentives tied to total shareholder return (TSR) spent cash relative to those firms with no shareholder return incentive.

Id.

[48] Section 1502 – Conflict Minerals – Congress enacted this provision because it believed that the “exploitation and trade of conflict minerals originating in the Democratic Republic of the Congo is helping to finance conflict characterized by extreme levels of violence in the eastern Democratic Republic of the Congo, particularly sexual- and gender-based violence, and contributing to an emergency humanitarian situation.”  Accordingly, it amended the Exchange Act, adding a new subsection (p) to Section 13 which directs the SEC to adopt rules requiring reporting issuers to disclose whether “conflict minerals” that are necessary to the functionality or production of an issuer’s product originate in the Democratic Republic of the Congo or an adjoining country.  It imposes several other requirements such as requiring reporting companies to have an independent audit of the source and custody of such minerals.  The SEC proposed rules to comply with the provision. Release No. 34-63547 (Dec. 15, 2010); 75 FR 80948 (Dec. 23, 2010).  The Commission extended the comment period for 30 days.  Release No. 33-9179 (Jan. 28, 2011); 76 FR 6110 (Feb. 3, 2011).  The Commission subsequently adopted final rules. Release No. 34-67716 (Aug. 22, 2012); 77 FR 56274 (Sept. 12, 2012).[48]  The National Association of Manufacturers (NAM) challenged the rules in the U.S. District Court on several grounds, including a First Amendment claim.  The District Court upheld the SEC’s rules.  Nat’l. Ass’n. of Mfrs. v. SEC, 956 F. Supp. 2d 43, 46 (D.D.C. 2013).[48]  The NAM appealed the District Court’s decision to the U.S. Court of Appeals for the District of Columbia Circuit, which rejected all of the objections except for the First Amendment.  The court stated that Section 13 (p)(1)(A)(ii) & (E) and the Commission’s final rule “violate the First Amendment to the extent the statute and rule require regulated entities to report to the Commission and to state on their website that any of their products have “not been found to be ‘DRC conflict free.’”[48]  Nat’l. Ass’n. of Mfrs. v. SEC, 748 F.3d 359,374. (D.C. Cir. 2014).  On April 29, 2014, Keith Higgins, Director of the Division of Corporation Finance, issued guidance stating that issuers need not file those aspects of the reports that the Court of Appeals disallowed.  The SEC and Amnesty International, an intervenor, petitioned the Court of Appeals for a rehearing in light of a subsequent Court of Appeals decision.  However, the Court of Appeals reaffirmed its earlier opinion.  The court noted that “by compelling an issuer to confess blood on its hands, the statute interferes with that exercise of the freedom of speech under the First Amendment.” Nat’l. Ass’n. of Mfrs. v. SEC, No. 13-5252 (Aug. 18, 2015) (2015 Opinion).  Ultimately, the SEC’s Division of Corporation Finance stated that it “will not recommend enforcement action to the Commission if companies, including those that are subject to paragraph (c) of Item 1.01 of Form SD, only file disclosure under the provisions of paragraphs (a) and (b) of Item 1.01 of Form SD.”  Updated Statement on the Effect of the Court of Appeals Decision on the Conflict Minerals Rule, SEC Division of Corporation Finance, Apr. 7, 2017.

[49] Section 1503 – Reporting Requirements Regarding Coal or Other Mine Safety – This provision requires issuers that operate coal or other mines to report their safety records to the SEC, in addition to any other requirements of mine safety regulators.  For example, Section 1503(a)(1)(A) requires issuers to report on periodic reports information such as the number of citations that the Mine Safety and Health Administration has levied against the issuer. (The Mine Safety and Health Administration is part of the U. S. Department of Labor.)  Section 1503(b)(2) require an issuer to file a current report on Form 8-K if the Mine Safety and Health Administration notifies the issuer that the mine has a pattern of violations of mandatory health or safety standards of a serious nature.  Although the provision was self-executing, the SEC proposed and adopted rules.[49]  These rules amended SEC forms 8-K, 10-Q, and 10-K to make accommodations for Section 1503’s requirements.

[50] Section 1504 – Resource Extraction – This provision amended Section 13 of the Exchange Act and directed the SEC to adopt rules requiring issuers engaged in “resource extraction” to include in their annual reports “information relating to any payment made by the resource extraction issuer … to a foreign government or the Federal Government for the purpose of the commercial development of oil, natural gas, or minerals….”  In 2010, the SEC proposed rules to implement this section in accordance with the statutory mandate. Release No. 34-63549 (Dec. 15, 2010); 75 FR 80978 (Dec. 23, 2010).  The SEC adopted final rules in 2012.  Release No. 34-67717 (Aug. 22, 2012); 77 FR 56344 (Sept. 12. 2012) (“2012 Rules”).[50]  However, on July 2, 2012, the U.S. District Court for the District of Columbia vacated the 2012 Rules. American Petroleum Institute v. SEC, 953 F. Supp. 2d 5 (D.D.C., 2013). The court stated that “the Commission misread the statute to mandate public disclosure of the reports, and its decision to deny any exemption [for countries that prohibit payment disclosure] was … arbitrary and capricious.”  953 F. Supp. 2d., at 12.  See also: Oxfam America, Inc. v. SEC, Civ. Action No. 14-13648-DJC.  In that case, Oxfam successfully argued that the SEC unlawfully withheld agency action when it did not adopt final rules within the time period that Congress mandated.  The U. S. District Court for the District of Massachusetts ordered the SEC to submit a schedule for completing the rulemaking.  On December 11, 2015, the SEC reproposed the rule to implement Section 1504. Release No. 34–76620 (Dec. 11, 2015); 80 FR 80057 (Dec. 23, 2015). The Commission adopted final rules again on June 27, 2016. Release No 34-78167 (June 27, 2016); 81 FR 49360 (July 27, 2016) (“2016 Rules”).  Congress subsequently invalidated the 2016 Rules.[50]  On December 18, 2019, the SEC proposed a third set of rules. Release No. 34-877883 (Dec. 18, 2019); 85 FR 2522 (Jan. 15, 2020).  The Commission adopted those rules on December 16, 2020.  Release No. 34 90679 (Dec. 16, 2020); 86 FR 4662 (Jan. 15, 2021).  See also: SEC Adopts Final Rules for the Disclosure of Payments by Resource Extraction Issuers, SEC Press Release 2020-318 (Dec. 16, 2020).

[51] Acting Chairman Piwowar expressed doubt about the efficacy the Conflicts Mineral disclosure requirements after a visit to Africa.  He thought that the rules were causing more harm than good.  He requested public comments on whether Section 1502 and the SEC’s rules were achieving the humanitarian objective that Congress sought.  The Commission received many comments on the efficacy of the requirement.  E.g., comment of Mr. Murairi Janvier Bakihanaye, Civil Society, Goma, The Democratic Republic of Congo, Mar. 21, 2017: “The Dodd-Frank Act is truly worth its weight in gold.” 

[52] Mary Jo White, Chair, SEC, The Importance of Independence, 14th Annual A.A. Sommer, Jr. Corporate Securities and Financial Law Lecture, Fordham Law School, Oct. 3, 2013.  Earlier in her remarks, Chair White pointed to an older example when Congress required all federal agencies to consider environmental issues as part of their mandates.

[53] Basic Inc. et al v. Levinson et al., 485 U.S. at 240.

[54] SIFMA, 2020 Capital Markets Fact Book, Sept. 2020, at 7.

[55] Section 20(b) of the Exchange Act provides that: “It shall be unlawful for any person, directly or indirectly, to do any act or thing which it would be unlawful for such person to do under the provisions of this title or any rule or regulation thereunder through or by means of any other person.”  Although not legally binding on the SEC, it seems to the author that the federal government should honor the same admonition.  In other words, the government should not seek to achieve indirectly a goal for which it lacks direct authority.

[56] E.g., Congressional Budget Office, The Budgetary Effect of the Raise the Wage Act of 2021 (Feb. 2021).  The report notes, at 8:

CBO projects that, on net, the Raise the Wage Act of 2021 would reduce employment by increasing amounts over the 2021–2025 period. In 2025, when the minimum wage reached $15 per hour, employment would be reduced by 1.4 million workers (or 0.9 percent), according to CBO’s average estimate. In 2021, most workers who would not have a job because of the higher minimum wage would still be looking for work and hence be categorized as unemployed; by 2025, however, half of the 1.4 million people who would be jobless because of the bill would have dropped out of the labor force, CBO estimates. Young, less educated people would account for a disproportionate share of those reductions in employment.

[57] One study from Nasdaq shows that companies are staying private longer than in prior years.  Mackintosh, The Battle for Public vs. Private Equities, Nasdaq, Feb. 27, 2020. See also MacArthur, Burack, De Vusser, Yang, and Rainey, Public Vs. Private Assets: The Big Switch, Bain & Co., Feb. 25, 2019. 

[58] Mackintosh, supra.

ESG In Action: Diversifying Corporate Governance

Before environmental, social, and governance (ESG) matters became cultural and business movements, the lack of diversity and inclusion within corporate governance structures was noted but not scrutinized.  Now, there at least ten pending shareholder derivative lawsuits alleging that a lack of board and management diversity constitutes a breach of fiduciary duty.  Organizations that lack diversity in their corporate leadership are also subject to increased regulation and directives in state laws, investment bank requirements, and potential industry edicts.  Despite substantial research establishing the social and economic benefits of diverse boards, changing the face of corporate governance remains difficult.  This article will:

  • examine the issues presented by the suits, regulations, and mandates; and
  • provide simple (but not easy) steps companies can take to begin the diversification of corporate governance.

Board Diversity Lawsuits

The pending shareholder actions, most filed by the same group of firms and targeted at many companies identified in a recent Newsweek article that listed companies without a black director, generally assert that the defendants:

  • breached their fiduciary duties; and
  • violated Section 14(a) of the Securities Exchange Act;

by making false or misleading public statements regarding the company’s commitment to diversity even though their boards and management did not include racially diverse – specifically black – directors.  To underscore this point, most of the complaints contain photographs of racially homogeneous current board members. 

Though the well-established “Caremark” duties – outlined in In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996) – are not expressly referenced in the complaints, they certainly influence the plaintiffs’ arguments that the boards breached their fiduciary duties when they:

  • failed to prevent violations of law by allowing discriminatory practices concerning governance;
  • did not make diverse board appointments; and
  • authorized false statements about diversity priorities to be made in proxy documents despite a lack of governance diversity.

To address these breaches, the aggrieved shareholders’ suits demand:

  • quantifiable plans to achieve board diversity and inclusion;
  • annual diversity reports on hiring, advancement, promotion and pay;
  • annual diversity and inclusion training;
  • funds (measured in the hundreds of millions) to hire and promote diversity throughout the corporation;
  • creation of open seats for new, and appropriately compensated, diverse directors; and
  • attorneys’ fees.

While the purpose of these suits is laudable, significant threshold legal questions exist.  First, the suits typically allege “demand futility” to explain why underlying diversity concerns were not taken to the board as opposed to directly filing suit.  Considering the focus on diversity issues in the new ESG environment, and the lack of any detail regarding board processes and deliberation, whether such requests were futile is a crucial issue to be resolved by the courts.  Next, statements regarding legal or ESG compliance are not typically actionable.  Finally, causation and damages will be high hurdles, since a direct relationship between board diversity/ESG failures and actual shareholder harm must be established.  Plaintiffs currently allege that greater board diversity leads to greater profits, relying upon, among other things, a 2018 McKinsey & Company report noting that companies with more diverse boards were more likely to have higher profits.  However, correlation is not legal causation, and it will be difficult to convince courts that studies like this justify ignoring the protection of the Business Judgment Rule.

Recognizing many of these defenses, the U.S. District Court for the Northern District of California dismissed a board diversity lawsuit against Facebook in a March 19, 2021 order. The Court found that plaintiffs in Ocegueda v. Zuckerberg, N.D. Cal., No. 3:20-cv-04444, did not plausibly plead demand futility or “a materially false statement” under Section 14(a). 

That said, a legal victory may not be the goal.  Faced with similar allegations from some of the same lawyers in the board diversity suits, Google’s parent recently settled its #MeToo derivative litigation by, among other things, creating a $310 million diversity, equity, and inclusion fund (operating over the next 10 years) to support global diversity and inclusion initiatives within Google, and supporting various ESG programs outside Google focused on the digital and technology industries. Ergo, the ultimate goal of the board diversity suits may be similar settlements and capitulations.

Regulatory, Industry, and Shareholder Engagement Efforts

While the lawsuits are the most recent effort to spur board diversity, they were preceded by federal and state regulatory efforts.  The Securities and Exchange Commission (SEC) has issued compliance interpretations advising companies on how to disclose diversity characteristics they rely on when nominating board members.  And in November 2019, the House of Representatives considered a bill requiring issuers of securities to disclose, among other things:

  • the racial, ethnic, and gender composition of their boards of directors and executive officers; and
  • any plans to promote such diversity.

California was the first state to require that public companies headquartered there have a minimum number of female directors in 2019 or face sanctions, with the minimum to be increased in 2021.  In June 2020, New York began requiring companies to report how many of their directors are women.  More recently, California has mandated that public companies headquartered in the state elect at least one director from an underrepresented community by December 2021, or face up to $300,000 in fines.  For boards with between four and nine directors, two such directors must be in place by December 2022 and companies with more than nine directors must have three.  Considering these regulations, it is no coincidence that the vast majority of board diversity suits were filed in California.

At the industry level, the NASDAQ exchange (on which many of the board diversity defendants are listed) filed a proposal with the SEC to adopt regulations that would require most listed companies to elect at least one female director and one director from an underrepresented minority or who identifies as LGBTQ+.  If adopted, the tiered requirements would force noncompliant companies to disclose the reasons for any failure to meet this diversity mandate in the company’s annual meeting proxy statement or on its website. The SEC has solicited public comment on this proposal.

In the private sector, institutional investors such as BlackRock and Vanguard have encouraged companies to pursue ESG goals and disclose the racial diversity of their boards, using proxy votes to advance such efforts. Separately, Institutional Shareholder Services, many private and public companies, and some non-profit organizations have either encouraged companies to disclose their diversity efforts or have signed onto private challenges and pledges to increase the diversity on their boards.

Concrete Plans Can Decrease Director Risk

The business and social benefits of diversity are well established; and successful companies know that an organization’s diversity commitment cannot be rhetorical and may be measured by the number of their diverse board and management leaders.

As pending lawsuits and legislation use diversity statements to form the basis of liability and/or regulatory culpability, companies should ensure that their diversity proclamations are fully supported by their actions. Among other things, boards should:

  • Take the lead from public and private efforts and review – and (if necessary) reform – board composition to open or create seats for diverse directors.
  • When recruiting new board members, identify and prioritize salient diversity characteristics; if necessary, utilize a diversity-focused search consultant to ensure a diverse pool of candidates.
  • Develop a quantifiable plan on diversity issues by reviewing and augmenting governance guidelines, board committee efforts, and executive compensation criteria.
  • Create and promote diversity and inclusion goals and incorporate training at the board and management levels.
  • Require quarterly board reporting on diversity and inclusion programs to reveal trends and progress towards stated goals.

As companies express their commitment to board and C-Level diversity and other ESG efforts through public statements, investor engagement and shareholder proposals, recent litigation and regulatory trends should encourage companies to move beyond platitudes and, instead:

  • create and follow concrete plans with defined goals; and
  • meticulously measure their progress.

Want more? Participate in a live CLE webinar on this topic at the upcoming Business Law Virtual Spring Meeting! The program, “Diversifying Corporate Governance Institutions: Who Should Be At the Table?,” will be presented on April 23, 2021, at 12:15pm CT. Registration is completely free for Business Law Section members—sign up now!

Brazil’s Reorganization Law Finds a Way During the Pandemic

New legislation went into effect in Brazil on January 23, 2021 that made improvements to its judicial reorganization and bankruptcy law.  The amendments are known as Federal Law No. 14,112/2020 and modify Federal Law No. 11,101/2005. Federal Law No. 11,101/2005 introduced the recuperacão judicial (RJ) proceeding, which is designed to promote restructuring of insolvent businesses under court supervision.  The introduction of RJ in 2005 was the last major insolvency in reform in Brazil until this year.

Chapter 11 is a source of inspiration for RJ.  Yet Brazilian courts and parties in interest have still struggled with areas of uncertainty and inefficiency in RJ’s implementation over the last 16 years. 

From a creditors’ perspective, RJ did not give them the ability to wipe out equity or propose a plan even if the debtors’ proposal was unworkable.  The only right creditors seemed to have was attempting to force a liquidation.  Also, insufficient guidance in RJ on substantive consolidation created unpredictability in credit decisions, the ability to vote on plans, and protecting entity-specific claims.

RJ posed challenges for debtors who lacked financing options to fund their reorganization efforts or the ability to sell assets free and clear in order to generate cash.  Debtors also did not have the ability to file an insolvency proceeding in another jurisdiction and have it recognized in Brazil.

The COVID-19 pandemic revived dormant legislation to improve RJ, as the Brazilian government considered measures to alleviate the disease’s severe public health and economic impacts. The amendments in Federal Law No. 14,112/2020 were signed into law on Christmas Eve 2020 (with some presidential vetoes).  The new law attempts to remedy the previous ambiguities and has the potential to improve outcomes for creditors and debtors.  The changes to the RJ statute include, among other things:

(1) empowering creditors to file a plan of reorganization,

(2) regulating procedural and substantive consolidation,

(3) enabling debtors to obtain debtor-in-possession financing,

(4) permitting the sale of assets free and clear, and

(5) recognizing foreign insolvency proceedings involving Brazilian debtors.

Under the 2005 RJ law, only debtors had the ability to propose a plan of reorganization, and they were not bound by any firm deadline for submitting such a plan.  Debtors also had the ability to indefinitely suspend the formal meeting of creditors, where votes are taken to approve plans.  The 2021 RJ law requires debtors to file a plan within 180 days, subject to only one 180-day extension; debtors cannot suspend the creditors’ meeting for a period longer than 90 days. 

The new law allows creditors to propose plans if certain conditions are met.  If the debtor’s plan is rejected at the creditors’ meeting, and a majority of the creditors in attendance support the concept of submission of a creditors’ plan, creditors will have 30 days to file one.  If such a plan has sufficient creditor support, it will go to a vote at a new creditors’ meeting.  The law also gives creditors the ability to attend the meetings remotely by electronic means.  The right to file a plan, however, does not make creditors all-powerful, because shareholders cannot be forced to capitalize the company or remain if their shares are diluted, and individual guarantors must be released.

Consolidation of debtors and their assets and liabilities will now be governed by the RJ statute.  As an administrative matter, debtors may obtain procedural consolidation so that members of the same corporate group can proceed in a joint case.  A court may also impose substantive consolidation of assets and liabilities, but the court must find that there was interconnection and commingling according to statutory standards rather than on an ad hoc basis.

The 2021 updates may facilitate additional liquidity for business operations in the RJ process.  Debtors will now have the right to seek debtor-in-possession financing in a way that may be more appealing for lenders.  Such loans will be junior only to certain administrative expenses, labor claims incurred only three months before liquidation, and holders of security interests.  However, priming liens are not available without consent of the senior parties.  Anyone, even shareholders and prepetition creditors, may be approved by the court to make postpetition loans.  If loan disbursements have been made, the lender will maintain priority even if the approval is reversed on appeal.

The new law allows assets to be sold free and clear.  One way debtors can accomplish this is by selling shares in new entities known as “isolated business units” in which any kind of assets may be deposited, including the business as a going concern.  In such sales, creditors who would otherwise be unaffected by the RJ proceeding must remain entitled to payment on conditions no worse than they would have in a liquidation.  Yet a presidential veto created an important limitation on these sales that affects the debtor’s ability to generate proceeds quickly: unlike sales under Section 363 of the Bankruptcy Code, RJ sales may only be conducted if approved in connection with a confirmed plan, which could add months to the process.

Under the 2021 RJ law revisions, insolvency proceedings in other countries can now be recognized by Brazilian courts, so that assets in Brazil can be protected from creditors without requiring the enterprise to go through RJ.  The amendments incorporate the provisions for cross-border cooperation of the UNCITRAL Model Law.  Debtors may now do the equivalent of a Chapter 15 in Brazil while pursuing Chapter 11 in the United States (if venue is available) for their overall restructuring.

The timing of these amendments is opportune in light of the harsh impacts of the pandemic on Brazil.  Over a quarter-million Brazilian lives have been lost, and our sympathies are with Brazil’s citizens.  Enlightened and science-based governmental action can improve outcomes, in health and economics.  We hope that the revised RJ will allow Brazilian enterprises and their investors to dar um jeito (find a way) in these difficult circumstances.

Data Breach Remediation

Whether accidental or due to a deliberate penetration of information systems, data breaches – while not solely a 21st-century phenomenon – are an increasingly sophisticated headache for global corporate entities. As personal information and corporate data have become commoditized, the legal, gray and black markets for information have seen the exponential rise of an industry whose primary function is reactive data breach management, remediation and mitigation. After a data breach, an organization’s primary objectives are complying with the regulatory obligation to notify potentially impacted individuals while limiting its financial exposure. This requires the review of many thousands – sometimes millions – of documents. For many companies, the data remediation action ends when all required notifications are sent. This complacency can have grave consequences; there are other significant post-data breach business risks that should be evaluated. It is in a company’s best interest to utilize its expert resources to help mitigate those risks in parallel with fulfilling the legal requirements of remediation and notification.

To understand the business risks of a data breach beyond the costs of conducting remediation, companies need to be aware of the current corporate cybercrime landscape. In August 2020, INTERPOL assessed the impact COVID-19 has had on cybercrime incidents, noting that they were seeing a dramatic shift away from attacks on individuals and a significant increase in attacks on larger enterprises. In a related press release, INTERPOL noted that, “With organizations and businesses rapidly deploying remote systems and networks to support staff working from home, criminals are . . . taking advantage of increased security vulnerabilities to steal data, generate profits and cause disruption.”[1] Sophisticated criminals and criminal organizations are masters at identifying changing cultural, political and market conditions to capitalize on opportunities that maximize illicit financial gains. The pandemic has led to a wave of uncertainty and anxiety that spans the hierarchies of corporate organizations. The resulting instability of global economic conditions, along with already troubling sociopolitical volatility, has left institutions less prepared than ever to contend with the sudden onslaught of online assaults by highly skilled hackers who are often one step ahead of even the most protective IT security programs.

The fact that data breach risks are always looming, regardless of threat level, is nothing new. Corporations that have faced one before are well-aware of the potentially enormous cost of remediation. Data privacy attorneys are particularly well-acquainted with what a data breach means for their clients and the existence of aggressive regulations from multiple jurisdictions that dictate the manner and time frame for notifying individuals whose personally identifiable information (PII) has been compromised. Regulatory bodies are often inflexible, and the speed at which corporations must fully implement a remediation and notification plan is often faster than one might consider reasonable. Once a breach is identified, companies are in triage mode to protect their reputation and mitigate their financial exposure while simultaneously isolating the impacted servers to mitigate the damage from an attack, boosting their cyber resiliency to help prevent further attacks and implementing a data breach remediation review to send the required notifications to individuals.

However, the lost confidence and financial harm stem from more than the theft of PII. Companies understand that it is their proprietary, confidential data that makes what they sell valuable. This information would be exceptionally valuable to competitors and, if stolen, could be made public to embarrass or sold for profit. According to a 2020 IBM study, it takes an average of 200 days before a company realizes a cyberattack has occurred, by which time it can be nearly impossible to recover from the loss of corporate secrets. Exposed competitive information like pricing or fees negotiated with other companies, marketing plans and product development documents are just a sample of the types of information that could be floating around cyberspace for months unbeknownst to a company. Furthermore, private internal or external email or chat conversations could be the source of embarrassment – or even regulatory interest – if made public.

Separate from internal information, confidential data belonging to other entities like vendors, partners, customers, etc. helps keep companies profitable and running smoothly. Protecting these relationships is critical, and they can be easily damaged if a company has put another company’s information at risk. Identifying breached sensitive business data as soon as an intrusion is spotted is a first step toward preventing an irretrievable breakdown of business relationships. With certain exceptions – like law firms – regulations do not necessarily demand that a company do anything to mitigate the risks that may come from the loss of another company’s information. However, statutory obligations are not the only considerations. Commercial relationships are almost invariably governed by contracts between parties which often contain data security requirements, call for cyber insurance and – if written appropriately – have strong indemnification language. With this heightened exposure, it is incumbent on companies to be proactive in identifying compromised business data and notifying their owners.

If a company is prepared with a comprehensive data breach review plan that accomplishes the identification of PII for remediation and notification, as well as identifying internal company-owned data and third-party business-owned data, it will be in a much better position to limit financial exposure, reputational harm and loss of critical relationships. To do this most effectively and efficiently, it is important to have a data remediation review team with members who are not only skilled at thoroughly identifying PII of all types as well as the contact information of impacted individuals for legally required notifications, but also have significant experience identifying critical business data and categorizing it in reports so that internal departments and outside companies can be notified with specificity about data that has been potentially compromised. The tight timelines for completing PII remediation and notification do not mean business data should be sidelined. Data remediation review teams are able to review documents for both PII and business information simultaneously if they have the training and experience to know what to identify. A single review with this dual purpose allows companies to accomplish what might otherwise be overlooked or delayed with minimal additional time and cost.


[1] “INTERPOL report shows alarming rate of cyberattacks during COVID-19,” August 4, 2020, available at: https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-report-shows-alarming-rate-of-cyberattacks-during-COVID-19