TECHNOLOGY, OUTSOURCING, AND COMMERCIAL TRANSACTIONS
NEWS FOR LAWYERS AND SOURCING PROFESSIONALS

The Stop Hacks and Improve Electronic Data Security (SHIELD) Act was signed into New York law by Governor Andrew Cuomo on July 25, after passing the New York State Assembly on June 17. The SHIELD Act takes effect on March 21, 2020, and will modernize New York’s current laws governing data breach notification and data security requirements with the intention of providing greater protection for consumer's private information, while holding companies accountable for providing such protections.

Read our previous post on the SHIELD Act for more information.

As lawmakers, policymakers, tech companies, and other data collectors try to determine how much access and control of consumer data is appropriate or acceptable, and how much notice and choice consumers should have, consumers will ultimately be the arbiter of such access and use.  

A recent New York Times article discusses the efforts of lawmakers to require internet companies to be more transparent with consumers regarding the data collected and the specific value associated with such data. The article goes on to say there is a growing sentiment that the imbalance of power between internet companies and consumers vis-à-vis the value of the data collected, and that consumers should know and benefit from the true value of the data they provide by utilizing the services.

Open source programs are becoming a best practice in the technology, telecom/media, and financial services industries. Companies are establishing open source best practices to streamline and organize the way their employees use open source, focusing on long-term business plans. Since open source, a collaborative development process, varies so greatly from traditional software practices (i.e., proprietary and closed), companies are creating their own open source programs and policies to manage how it is used and how it can work best for the company’s long-term goals. Naturally, large technology companies are leading the way in establishing open source best practices, but open source is becoming commonplace for both tech and non-tech companies.

Open source programs are typically created by a company’s software engineering or development department for informal use and then eventually grow to a “formal” program with a collection of policies and guidelines. These policies may include open source contributions, a list of acceptable licenses, and the use of OS code.

When an inventor of technology who is also a university employee wants to commercialize university-developed technology, it is customary for the university and the inventor to “spin out” the technology via a license agreement to a newly created company (a licensee company) that sets forth the terms of the license, including any necessary milestones for advancing the technology, restrictions on the use of the technology, and the royalties and other financial terms applicable to the licensing and commercialization of the technology.

Executive Order 13873 was issued on May 15 with the goal of “Securing the Information and Communications Technology and Services Supply Chain.” The order ultimately seeks to manage the national security risk that can exist in information and communications technology (ICT) transactions between those subject to US jurisdiction and those subject to the jurisdictions of foreign adversaries. The order defines “information and communications technology or services” as “any hardware, software, or other product or service primarily intended to fulfill or enable the function of information or data processing, storage, retrieval, or communication by electronic means, including transmission, storage, and display.” A “foreign adversary” is defined in the order as “any foreign government or foreign non-government person engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or security and safety of United States persons.”

Internet-connected devices contributing to the Internet of Things (IoT) are projected to exceed 50 billion devices by 2025, according to the Federal Trade Commission’s Bureau of Consumer Protection in its June 2018 comments on the Consumer Product Safety Commission’s notice of public hearing and request for written comments on “The Internet of Things and Consumer Product Hazards.” Such widespread use of and access to these internet-connected devices—which can collect personal data from their users—has spurred legislative movement toward introducing security standards for IoT devices. These initial steps start with the US government’s use of IoT devices through the Senate’s third proposed bill on the subject, S.734. The bill, known as the Internet of Things Cybersecurity Improvement Act of 2019, aims to manage cybersecurity risks regarding secure development, identity management, patching, and configuration management of “covered devices.” Under the proposed bill, a “covered device” is one that can connect to the internet, has data processing capabilities, and “is not a general-purpose computing device.” The covered devices at the focus of this bill refer to devices “owned or controlled by” the federal government.

Since the US Supreme Court’s June 21, 2018, decision in South Dakota vs. Wayfair, Inc. , many of the 45 sales tax-collecting states have been making moves to put laws and processes in place for tax collections for out-of-state online sales. Given the general complexity of state tax laws and the inconsistency from state to state, as well as the uncertainty as to whether or when uniformity across states may come to pass, businesses with online sales need to carefully monitor both the legal landscape and the processes established for administration and compliance for out-of-state transactions.

More than 1,000 Support Anti-Terrorism by Fostering Effective Technologies Act (SAFETY Act) of 2,002 approvals have been granted by the US Department of Homeland Security (DHS) since the act’s inception. Many professional sports teams in the National Football League, Major League Baseball, and National Basketball Association have had their venues certified under the SAFETY Act. For example, New Era Field for the Buffalo Bills became the 14th NFL stadium to receive a SAFETY Act certification in October 2018. However, professional sports leagues do not have a monopoly on large sporting events that garner huge crowds—some universities have football stadiums with capacity for more than 100,000 people.

As companies continue to improve the cyber defenses of their computer systems operating key enterprise and national infrastructure, one area that presents unique challenges is the supply chain. A single asset may depend on multiple vendors around the world, some of whom may only produce a single component or piece of software, but any of which can introduce critical vulnerabilities. Please join us for a one-hour webinar to discuss best practices in supply chain cybersecurity to mitigate these risks.

China introduced a new Foreign Investment Law on March 15, which, among other things, aims to encourage cross-border technological cooperation. In this LawFlash, Shanghai partner Todd Liao discusses related amendments to various Chinese regulations that affect technology transfer deals between foreign technology owners and Chinese licensees.