by Erin Arvedlund and Aubrey Whelan A New Jersey woman has sued the Chester County addiction rehab facility where her 29-year-old son fatally overdosed two days after arriving last fall, according to court documents. Christine Vernile of Sewell wrote in the suit that son Joel overdosed on fentanyl in his room at Recovery Centers of America’s Devon location on Oct. 5, and asked for compensatory and punitive damages for negligence and wrongful death. Click here for story

On April 24, 2020, Congress passed, and President signed, an additional $310 Billion of funding to replenish the Paycheck Protection Plan (PPP) after the initial $350 billion of the program’s funding was exhausted.  Applications for new funding will be accepted on April 27, 2020.  While the PPP program was lauded by businesses and the public at large, the roll out of the program has been criticized as providing PPP funding to large well capitalized businesses with access to the financial resources to keep them afloat during COVID-19 shutdown.  The programs rules were lax enough to permit PPP loans to be issued to publicly traded companies with excess cash on hand, including to Ruth’s Chris Steakhouse ($20 million PPP loan), Shake Shack ($10 million PPP loan) and Potbelly ($10 million PPP loan).  Within the initial thirteen days of accepting applications, PPP funds were exhausted without providing the small businesses with the funding that was intended to help those businesses survive COVID 19 shutdowns and stay at home orders.             In order to correct the criticism of the allocation PPP funds, the second round of funding for the PPP has targeted small businesses as beneficiaries by setting aside $30 billion of funds for community development, financial institutions, banks and credit unions with less than $10 billion in assets, and an additional $30 billion banks and credit unions with assets between $10 billion and $50 billion in assets. As an additional protective measure, businesses applying for PPP loans must now certify that the loans are necessary and that do not have access other sources of funding to continue to make payroll and pay other business expenses during the COVID shut down.  In addition to the $310 billion allocated to the PPP, an additional $60 billion has been allocated to the Economic Injury Disaster Loan and Grant program, of which $50 billion will be directed to EIDL Loans and the remaining $10 billion will go towards EIDL Grants.  For more information regarding the PPP Loans and EIDL Loans and Grants for small businesses please see this link: https://astorweisskapl.wpengine.com/covid-19-financial-relief-available-to-small-businesses-2/ The attorneys at Astor Weiss’ Business Law Practice Group are here to help your company with any questions you may have about federal loan programs to get your business through these difficult times.  Anyone with questions about how their business may benefit from the Paycheck Protection Program, the Economic Injury Disaster Loan program, or any other federal or state business assistance programs should contact one of the attorneys in this group, whose contact information is listed below: David Mandel, Managing PartnerTherese Allison, AssociateOffice: (215) 790-0100Office: (215) 790-0100Direct: (215) 893-4959Direct: (215) 893-4971Direct Fax: (215) 400-2255Direct Fax: (215) 400-2241Email: dmandel@astorweiss.comEmail: tallison@astorweiss.com Stephen Green, Of Counsel Office: (215) 790-0100 Direct: (215) 751-1920  Fax: (215) 790-0509 

The coronavirus (COVID-19) pandemic has impacted the ability of businesses to perform contractual duties. Governments around the world, including the United States and U.S. states, have imposed prohibitions on going to work, leaving  home,  meetings,  travel,  eat-in restaurants, and other limitations. This paper discusses when a party may have a legal defense if it elects to not perform contract obligations. The defenses of Force Majeure, frustration and impracticability are explored. Force Majeure A Force Majeure clause (French for “superior force”) is a contract provision that allows a party to suspend or terminate the performance of duties under a contract. The scope of protection and remedies are established by the language of the contract. This is an example of a Force Majeure clause: Force Majeure. A party shall not be liable for any failure of or delay in the performance of this agreement for the period that such failure or delay is due to any strike, lockout, civil commotion, war like operation, invasion, rebellion, hostilities, military or usurped power, sabotage, governmental regulations or control, or through act of God (“FORCE MAJEURE”). Performance is not excused if performance resulted from general economic conditions. As examples, other triggering events in a Force Majeure clause could be fire, flood, hurricane, typhoon, earthquake, lightning and explosion or pandemic. A Force Majeure clause may provide that a party must take steps to mitigate the impact. When it first becomes known that a party will rely on Force Majeure, that party should send a formal written declaration of Force Majeure to the other parties to the contract. Under Pennsylvania law, the event alleged as an excuse must have been beyond the party’s control and not due to any fault or negligence by the non-performing party. Martin v. Commonwealth, 548 A.2d 675, 678 (Pa. Commw. 1988). The non-performing party must show that they took action to attempt to perform the contract regardless of the Force Majeure event. Gulf Oil Corp. v. Fed.Energy Regulatory Comm’n, 706 F.2d 444, 452 (3d Cir. 1983). Many Force Majeure clauses in effect today do not list pandemic, epidemic or disease. Without that language at first blush it may appear that the Force Majeure defense does not apply to performance impacted by COVID-19. A defense may be available, however, if the clause covers governmental regulations and those regulations had a serious negative impact on performance. Further, the world-wide recognition of the need to control COVID-19 and government’s “stay at home” orders may result in courts being more liberal in approving a Force Majeure defense. Impracticability or Frustration If there is no Force Majeure clause in a contract or if the clause does not provide protection, a party to avoid performance may rely on the common law doctrines of “frustration” or “impracticability.” In Pennsylvania it is difficult to meet the requirements for those defenses. As a general principle, a party assumes the risk of incapacity to perform its contractual duties. Craig Coal Mining v. Romani, 513 A.2d 437 (Pa. Super. 1986). To use frustration or impracticability as a defense for non-performance, the cost of performance must become so excessive and unreasonable that the failure to excuse performance would result in “grave injustice.” Gulf Oil Corp. v. Federal Power Commission, 563 F.2d 588, 599 (3rd Cir.1977), cert. denied, 434 U.S. 1062 (1977). As soon as it is known, a formal written declaration of frustration or impracticability should be sent to the other parties to the contract. In Dorn v. Stanhope Steel, Inc., 534 A.2d 798, 811-812 (Pa. Super  1987), appeal  denied, 544 A.2d 1342 (1988), the court said performance may be considered “impracticable” and excused because of extreme and unreasonable difficulty, expense, injury, or loss, such as severe shortage of raw materials or of supplies due to war, embargo, local crop failure or unforeseen shutdowns; or performance will involve a risk of injury to person or to property. Increases in costs unless well beyond the normal range, do not amount to impracticability. Id. citing Restatement (Second) of Contracts § 261. A party must establish that the act contemplated is incapable of being performed,  rather   than   the   fact   that   he   or   she   is   incapable   of   performing   it.   Luber v. Luber, 614 A.2d 771, 774 (Pa. Super.1992), appeal denied, 631 A.2d 1008 (Pa. 1993). The doctrine of frustration provides that the duty to perform is discharged when a party’s principal purpose is substantially frustrated without his fault and there is a violation of a basic assumption on which the contract was made. Stanhope Steel, supra at 811-812, citing Restatement (Second) of Contracts § 265. The doctrine applies if events occur that result in a situation radically different from the contemplation of the parties when the contract was made. Courts typically require proof of “impossibility” of performance in order to allow the defense of frustration. In Stanhope Steel, supra, defendant was losing vast amounts of money for 4 years, defendant’s largest creditor would no longer advance funds and defendant did not have enough money to pay its operating expenses and payroll costs. The court held that the defenses were not established because defendant failed to show a change in the business environment that was well beyond the normal range. Although the standard is high, courts have provided relief under defenses of impracticability and frustration. In Aluminum Co. of Am. v. Essex Grp., Inc., 499 F. Supp. 53 (W.D. Pa. 1980), a federal district court in Pennsylvania, held that under Indiana’s doctrines of impracticability and frustration of purpose, seller was entitled to reformation of a long-term contract where seller’s production costs rose greatly beyond the foreseeable risk and where, without judicial relief, seller stood to lose in excess of $60 million out of pocket during remaining term of contract. In Riger v. Maloney, 2014 WL 10919548, at *3 (Pa. Super. 2014)(not precedential), the court ruled performance of transferring a 401(k) account was suspended because a necessary document was located in a file with Superior Court and the duty of transferring the funds could not be carried out. In Murray v. Willistown Twp., 169 A.3d 84, 92-93 (Pa. Super. 2017), the court cited impracticability of performance and applied a reformation of a contract after certain insurance coverage required in the contract became unavailable. Parties will be urging courts to hold that the unique obstacles caused by COVID-19 support a defense of impracticality or frustration. Given the unprecented impact of the disease, courts may feel compelled to allow those defenses. Moving Forward Any decision on whether to declare Force Majeure, frustration or impracticability requires a detailed analysis based on the particular facts faced by a company and the applicable law. As an example, a company should evaluate whether their counterparties to contracts may declare justifiable release from performance. Some companies will be on both sides of this issue, as the performing party in some cases and the receiving party in others. Companies should look at both possibilities before taking a formal position on whether to declare Force Majeure, frustration or impracticability. Download the White Paper W. Mark Mullineaux, Esq. 610-291-3850 mmullineaux@astorweiss.com

Author: Therese Allison Over the last month businesses and their employees have questioned how they will survive the recent economic downturn. As of April 1, 2020 approximately 85% of the population in the United States is under state or local orders to stay at home, and the majority of states have closed schools and businesses that do not provide life sustaining services in response to the global COVID-19 pandemic. More recently, some states especially hard hit by COVID-19 have received designations as major disaster areas. While there is no clear time frame when this halt to our economic, educational and social engine will end, the massive toll that these closures will have on businesses and on individual employment is predictable. Fortunately the federal and state governments are taking action to assist businesses and their employees survive in these uncertain. The CARES Act Paycheck Protection Program In light of the anticipated and unprecedented toll on the welfare of this country Congress has approved the Coronavirus Aid, Relief, and Economic Security Act (the CARES Act) to provide financial relief to individuals and businesses. Small businesses can benefit from the $349 Billion dollars allocated through the CARES Act’s Paycheck Protection Program (the PPP). The program, enacted to help businesses retain their employees and meet their business expense obligations during this economic downturn, provides federally guaranteed low interest SBA loans that do not require collateral or guarantees from the borrower, and that may be forgiven if businesses use loan proceeds for permitted purposes and maintain their payroll through the end of June, 2020. Paycheck Protection Loan Eligibility Requirements The PPP, enacted as part of Title I to the CARES Act, is intended to protect small businesses from interruption due to the COVID-19 Pandemic. PPP loans are available to small businesses that were in operation before February 15, 2020 to assist businesses in maintaining employees on their payroll and paying other businesses expenses incurred during this period of business closures and stay at home orders. PPP loan terms will be two years and with a fixed interest rate of 0.5%, will have no pre-payment penalties Also, loan payments will be deferred for a period of six months from the loan origination date. A business will qualify as a “small business” under the Act if it has fewer than 500 employees (whether those employees are full time, part time or any other employment status); qualifies as a small business under the SBA’s size standards; or operates as a sole proprietor, independent contractor or self-employed business. In addition, the Act applies the 500 employee limitation on a per location basis for businesses in the food services and accommodation sector (any NAICS Code beginning with 72). Amount of Loan and Permitted Use of Proceeds Qualifying small businesses are eligible for loans up to 2.25 times the borrower’s average monthly payroll costs incurred over the twelve month period prior to the loan application, up to a maximum amount of $10 Million, the funds of which may be applied to expenses incurred by the borrower during any time period between February 15, 2020 and June 30, 2020. In calculating payroll costs, any employee whose salary exceeds $100,000 annually, must be capped at that number. The funds from the loan may only be applied to payroll costs, excluding prorated costs of salaries over $100,000 per year for any individual, costs related to the continuation of health care benefits, employee salary and commissions, interest payment on mortgage obligations, rent payments, interest on other debt obligations, and utility payments (the “Permitted Purposes”). Loan Forgiveness Up to 100% of Paycheck Protection loans are eligible for forgiveness where the funds are used for Permitted Purposes. PPP loan forgiveness is contingent upon the borrower maintaining its payroll. If employees are laid off during the period between loan origination and June 30, 2020, the portion of the forgiveness available to the borrower will be reduced by the percentage decrease in the number of employees. Further, if the borrower’s total payroll expense for workers earning less than $100,000 is reduced by more than 25% the forgiveness will be reduced by that same amount. However, if employees previously laid off are rehired by June 30, 2020, full forgiveness may be available to the borrower. Where the loan is used for both Permitted Purposes and other purposes, only the portion of the funds used for Permitted Purposes are eligible for forgiveness. Applying for a PPP Loan It is presently anticipated that applications for PPP loans will be available on April 3, 2020. Applications must be made through an SBA qualified lender. You should contact your regular bank to see if they are accepting such applications. While the final form of application has not been published yet, SBA has published a preliminary form and it is expected that the final form will be very similar, if not identical. Here is a link to that application. This should allow you to prepare the documentation you will need to submit with the application. Economic Injury Disaster Loan Program Under the CARES Act As illnesses mount and pressure on society to control the spread of the COVID-19 virus increases, states have begun applying to the federal government for declaration as major disaster areas. Disaster designations, such as the designation declared in Pennsylvania on March 30, 2020, make federal funding available to state and local governments and allow businesses to obtain assistance such as the Economic Injury Disaster Loan Program (the “EIDL”). The CARES Act created a new grant program to provide quick relief to businesses under the EIDL program where borrowers can receive up to $10,000 to cover immediate payroll, mortgage, rent and additional expenses. The EIDL grant does not have to be repaid to the SBA. The traditional EIDL loan program, administered by the SBA, provides loan proceeds up to $2 Million to businesses located in federally designated disaster areas that incur economic losses as a result of such disasters. EIDL loans remain available to small businesses, and may be an alternative to PPP loans. These loans are offered at an interest rate of 3.75% with a repayment term of up to 30 years. The proceeds of these loans may be used to pay fixed debt, payroll, accounts payable and other business obligations that a businesses in unable to meet as a result of the impact of the disaster. The current EIDL and PPP regulation guidance is unclear as to whether borrowers will receive a PPP loan if an application for an EIDL loan or grant is pending. In the event that EIDL grants are permitted upon the issuance of a PPP loan the amount of any EIDL grant issued will be deducted from the amount forgiven under the PPP loan. If an EIDL loan is issued prior to a PPP loan, a borrower may be able to refinance the EIDL loan into the PPP loan program. However, small business borrowers should consult with their SBA lender before submitting any loan application. The attorneys at Astor Weiss’ Business Law Practice Group are here to help your company with any questions you may have about federal loan programs to get your business through these difficult times. Anyone with questions about how their business may benefit from the Paycheck Protection Program, the Economic Injury Disaster Loan program, or any other federal or state business assistance programs should contact one of the attorneys in this group, whose contact information is listed below: David Mandel, Managing Partner Office: (215) 790-0100 Direct: (215) 893-4959 Direct Fax: (215) 400-2255 Email: dmandel@astorweiss.com Therese Allison, Associate Office: (215) 790-0100 Direct: (215) 893-4971 Direct Fax: (215) 400-2241 Email: tallison@astorweiss.com Stephen Green, Of Counsel Office: (215) 790-0100 Direct: (215) 751-1920 Fax: (215) 790-0509 Email: SGreen@astorweiss.com

BY: William Mark Mullineaux, Esq.* Sagan Medvec* On May 25th, 2018, the European Union’s (“EU”) General Data Protection Regulation (“GDPR”) goes into effect and it may shift the way you collect data, manage user information, and market to prospects even if you are not intentionally marketing to people in Europe. From this point onwards, businesses all over Europe are being forced into strict gdpr compliance rules that are changing the way they use data. Despite the fact that the GDPR is complex, the use of the following test will determine whether the GDPR applies to a particular company. Software companies will also want to know if their ecommerce platform is committed to gdpr compliance when selling and distributing their digital products. The GDPR regulates entities meeting one or both of these two criteria: (1) Companies “established” in the EU and involved with processing personal data; and/or, (2) Companies (a) involved with processing personal data of natural persons in the EU and (b) offering goods and services to natural persons in the EU or monitoring their behavior in the EU. GDPR Art. 2 ¶ 1; GDPR Art. 3 ¶ 1, 2. “Companies” refer to all types of business entities. [1]. The full GDPR, in a well-organized format is at https://gdpr-info.eu/art-1-gdpr/. All of the European Union’s member countries are listed in Footnote #2. [2]. The use of the test requires knowledge of the meanings of “processing,” “personal data,” “established,” “offer goods and services in the EU,” and “monitoring behavior of natural persons in the EU” and other information from the GDPR. *William Mark Mullineaux, Esq. is a partner with Astor Weiss Kaplan & Mandel, LLP at mmullineaux@astorweiss.com and 215-893-4956. *Sagan Medvec is the creative director and co-founder of BRAND LLAMA at sagan@brandllama.com and 1-877-902-7232. This paper provides the meaning of those terms and discusses the application of the terms. This paper provides a snapshot at some of the compliance requirements but recommendations on addressing any compliance issues are beyond the scope of this article. I. Does the GDPR apply to Your Business? Analysis of the answers to the following questions can be used to apply the test to any particular business. Question 1: Does the company or someone on the company’s behalf process personal data? [Answer of “no” means GDPR does not apply] The GDPR only applies if there is processing of personal data. See GDPR Art. 2 ¶ 1. The following are the definitions of those terms. A. Meaning of “personal data” and “processing.” The GDPR broadly defines “personal data” as “any information relating to an identified or identifiable natural person…” [3]. GDPR provides that personal data includes an “online identifier” meaning that email addresses, log on information and other online information are considered personal data. [4] The GDPR broadly defines “processing” as “any operation or set of operations which is performed on personal data or on sets of personal data…such as collection,…storage,… disclosure,…or destruction.” [5] Many in the United States use the term “PII” (personally identifiable information) to deal with potentially protected information. The GDPR meaning of personal data may be significantly different from a particular “PII” term in use by a company in the United States. When dealing with the GDPR, the GDPR meaning of personal data should be used and not a PII term that is familiar to the company. If a company has or controls any personal information of a natural person and does anything with that information, it very likely that the company is processing personal data as defined in the GDPR. It is hard to imagine a business activity of a significant size that does not involve processing of personal data as defined by the GDPR. Some common examples of personal data processing would include collecting email addresses for email newsletter or completing the contact form on your website. Even putting information from someone’s business card in your CRM or sales management tool may be included in these definitions, and so this should be considered when setting up your CMS system (click here for more info on that). B. The GDPR applies to “Controllers” and “Processors.” For the GPDR to apply, a company must be a “Controller” or a “Processor” as defined by the GDPR. A “controller” means a “natural or legal person…which, alone or jointly with others, determines the purposes and means of the processing of personal data….” GDPR Art. 4 ¶ 7 [6]. “Processor” means “a natural or legal person which processes personal data on behalf of the controller.” GDPR Art. 7 ¶ 8 [7]. The controller, alone or with others, is the “brains” and the processor does the processing on behalf of the controller. A controller has responsibility for the work of the processor since the processor is acting on behalf of the controller. A controller also has responsibility when it acts jointly with others when determining the purposes and means of the processing of personal data. If a company is not a “Controller” or a “Processor” as defined by the GDPR the GDPR does not apply. For example, a business owner who has a website that collects information in a contact form would be considered a “Controller.” An email marketing tool like Constant Contact or your website design firm that created the website may be considered a “Processor.” Question 2: Does a Company have processing activities related to (a) offering of goods or services to natural persons in the EU or (b) monitoring their behavior in the EU? [Answer of “yes” means GDPR applies] The GDPR regulates Controllers and Processors not established in the EU if processing activities relate to (a) offering of goods or services to natural persons in the EU or (b) monitoring their behavior in the EU. Article 3.2 (Territorial Scope) of the GDPR in part provides: (2). This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b) the monitoring of their behaviour as far as their behaviour takes place within the Union. GDPR Art. 3 ¶ 2 (emphasis added) GDPR Article 3 is very clear that the GDPR will regulate United States companies not established in the EU if the company does processing of personal data related to offering goods or services in the EU or monitoring behavior in the EU. This raises the question of the type of activities actually needed to satisfy the requirement of “processing related to the offering of goods or services.” GDPR Art. 3 ¶ 2(a). Recital 23 provides the following factors to be considered on the issue: factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union. GDPR, Rec. 23 The factors in Recital 23 indicate that just having a website accessible worldwide would not subject a company to regulation by the GDPR. A company would have to go further, like using the language or currency of any particular EU country or mentioning customers or users in the EU. On the other hand, if a company actually makes a sale or provide services in the EU, that would appear to be an affirmative activity that would generate jurisdiction over that company. Article 3 also raises the question of the activity needed to satisfy the requirement of “the monitoring of their behaviour … within the Union.” GDPR Art. 3 ¶ 2(a). The requirement for monitoring is met, for example, if “natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.” GDPR Rec. 24. In other words, the monitoring element is met if data is used to profile a natural person to predict preferences, behaviors and attitudes. Question 3: Is the company processing personal data and “Established” in the EU as defined by the GDPR? [Answer of “yes” means GDPR applies] Article 3.1 (Territorial Scope) of the GDPR in part provides: (1) This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. GDPR Art. 3 ¶ 1 (emphasis added) The GDPR regulates Controllers and Processors that process personal data and that are “established” in the EU regardless of whether the processing takes place in EU. As discussed above, it is very likely that a company of any size does process personal data, making that element easy to establish. The question becomes whether a company is “established” in the EU. A company is “established” if it has “effective and real exercise of any stable arrangements” in the EU. See Recital 22 of GDPR [8]. That means that a company must have more than a fly-by-night presence in order for the GDPR to apply to the company. Unfortunately, the term “effective and real exercise of any stable arrangements” in the EU is the type of term over which there is uncertainty and litigation. As an example, under the GDPR, a parent company with no direct activity in the EU could be deemed to be established in the EU by activity of a subsidiary. The GDPR specifically states that “[t]he legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.” GDPR Rec. 22. (Emphasis added). For the GDPR to apply pursuant to Article 3.1, it is not required that the company process personal data from an individual in the EU. Under the literal meaning of Article 3.1, if a parent processes personal data from only outside the EU, the GDPR would still apply if the parent through a subsidiary is considered established in the EU. See GDPR Art. 3 ¶ 1. A United States Court may not find jurisdiction against a parent based on these facts. If a parent itself has no direct contact with the EU and did not process any personal data from the EU, there could be a significant jurisdiction issue. Of course, most companies would not want to spend the time and money it would take to convince a court that the GDPR’s claim to jurisdiction goes too far and the GDPR does not have jurisdiction over that company. An analysis of international jurisdiction is beyond the scope of this paper. II. Exceptions: The GDPR does not apply to authorities investigating or preventing crime or to natural persons in the course of purely personal or household activity. The GDPR does not apply to the processing of personal data “by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.” GDPR Art. 2 ¶ 4. The GDPR does not apply to the processing of personal data “by a natural person in the course of a purely personal or household activity.” GDPR Art. 2 ¶ 3. III. It is a myth that the GDPR does not apply to companies outside of the European Union. Companies based in the United States are subject to GDPR compliance requirements if they are involved in processing personal data of people in the EU. The scope of these requirements is significant in reach and while they may be challenged in the future, they may currently impact a business severely with extremely high fines. Additionally, if you are a company targeting the EU for business and collecting any PII you may have to register a third-party as a representative within the boundaries of the EU to respond to violations of GDPR regulations. A third-party data protection authority agency may need to be named in your privacy policy and/or terms of use of your website or app as well to support the response to violations. IV. The GDPR applies to companies with less than 250 employees. There is a misconception that the GDPR does not apply to companies with fewer than 250 employees. The GDPR does apply to those smaller companies. The GDPR gives companies with less than 250 employees “a break” because those companies have a reduced record keeping requirement. The reduced requirement, however, does not apply if the company’s processing is likely to result in a risk to the rights and freedoms of natural persons from the EU, or the processing is not occasional, or the processing includes special categories of data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation) or personal data relating to criminal convictions and offences. V. List of some of the GDPR compliance requirements. Compliance requirements that apply to a particular company will depend on a variety of factors including the type and amount of data used by a company. This paper provides a snapshot of some of the compliance requirements and does not give any advice on how to comply. These are some of the GDPR compliance requirements: Processing of EU personal data must have a lawful basis listed in Article 6 of the GDPR. One of the six lawful grounds for processing data is consent of an individual. If consent is relied upon it must be given with deliberate action to opt in, not pre-ticked boxes Data Breach Notification Obligations Individual rights to information and access of data Individual rights to modify personal data and to have personal data erased Accountability regulations Data security regulations Record-keeping regulations Delegation of Processing- the company delegating processing must obtain written commitment from processor to comply with GDPR’s obligations Potential fines up to 20 million Euros or 4% of annual revenue, whichever is greater Required Appointment of Data Protection Officer The following companies must appoint a data protection officer: Public authorities or bodies, except for courts acting in their judicial capacity. Companies who process data requiring regular and systematic monitoring of data subjects on a large scale. Companies who process, on a large scale, any special category of personal data. This includes data which reveals racial or ethnic origin; political opinions; religious beliefs and other such information listed in Section IV above. Companies who process, on a large scale, personal data relating to criminal convictions and offenses All of these regulations can be found at https://gdpr-info.eu/art-1-gdpr/ FOOTNOTES: [1] In this paper, “companies” refers to all types of businesses, including Sole Proprietor, Partnership, General Partnership, Limited Liability Partnership, Corporation, Nonprofit Corporation, Limited Liability Company, Joint Venture, Association and any other type of legal entity. [2] The countries in the EU are: Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and the United Kingdom. The UK plans to finish withdrawing from the EU by March 29, 2019. [3] The GDPR definition of “personal data” is any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. GDPR Art. 4, ¶ 1. The definition is broad. Note that the inclusion of an “online identifier” applies to all persons that have electronic communications with the company and that contributes to the definition being very broad. [4] Id. [5] The GDPR definition of “processing” is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; GDPR Art. 4, ¶ 2. The definition is broad. [6] The GDPR definition of “controller’ is: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; GDPR Art. 4, ¶ 7. [7] The GDPR definition of “processor’ is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; GDPR Art. 4, ¶ 8. [8] Recital 22 of GDPR provides: Processing by an establishment. Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect. Disclaimer This paper is for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem. This paper does not create an attorney-client relationship with the authors. Download the White Paper

On November 21, 2016 Act 107 was adopted by the Pennsylvania legislature, effective February 21, 2017, adopting a new partnership act, a new limited partnership act, and a new limited liability company act (LLCs). In addition revisions were made to the laws governing limited liability partnerships (LLPs) and limited liability limited partnerships (LLLPs). LLPs and LLLPs are widely used by legal, medical and other professionals. Of particular note for LLPs and LLLPs in the new legislation is the revision of Section 8204 of the Associations Code. In brief, under prior law a partner in an LLP or a general partner in an LLLP was not vicariously liable for the malpractice or other wrongful acts or misconduct of other partners but was personally liable for other obligations of the LLP or LLLP. Under the newly adopted legislation, partner liability will be essentially the same as member liability in LLCs and shareholder liability in corporations, i.e. complete limited liability with respect to partnership liabilities of any kind arising after the effective date, other than the partner’s own malpractice or other misconduct. Also, the nature of the liability of a partner for the malpractice or other wrongful acts of a lawyer or other person under the partner’s supervision and control has been modified. Is this a subject of interest to you? By: Alan Molod

The opportunity to own equity in a company is one of the central reasons entrepreneurs found a business, and promising future equity to potential employees helps new companies attract the skilled people necessary to run and grow a successful business. Therefore, the promise of eventual equity ownership provides a powerful motivator for founders and employees to contribute their skills and expertise to building a business, and is one of the most valuable assets a new, pre-revenue, company has. For these reasons, many founders decide to subject both founder and employee equity to “vesting”, meaning that full legal ownership of the equity accrues over time. Vesting can take multiple forms, such as granting a founder or employee an option contract to purchase equity units in the future, using a restricted unit arrangement that transfers some, but not all, of the benefits of equity ownership, or reserving a right to repurchase equity units that eventually lapses. Further, the triggers that transfer full ownership of the equity can vary, and include the simple passage of time, the achievement of corporate milestones, or revenue targets. However, regardless of the specific structure a vesting arrangement takes, subjecting founder and employee equity grants to vesting motivates these people to remain involved in the business, and to continue contributing to their skills to developing the company. If you would like to find out more about equity management when it comes to starting your own businesses, you may want to visit somewhere similar to Early Growth to find out more. Our law firm has helped founders structure vesting arrangements for founder and employee equity. If you are considering starting a business and would like to learn more about how our law firm can help you succeed, call us, let’s talk.            

A Pennsylvania court may interpret a written commercial contract by defining words based on “industry” meanings known as “trade usage.” Courts will go so far as to add an “invisible” term by inferring it into the contract.  For example, a Court may add terms not stated in the contract such as terms inferred from course of dealing and trade usage. What are these “invisible terms?” A course of dealing is a sequence of previous conduct between the parties to a contract which establishes a meaning of a contract term. As an example, a buyer of widgets for three years paid a seller on the 15th day after the goods were delivered and neither side complained about that practice. The payment by the 15th day after delivery becomes part of the contract. A “usage of trade” is based on industry practice and refers to a use having regularity of observance in the trade. As an example, company A agrees to sell 1,000 feet of “San Domingo mahogany” to company B. By usage of mahogany dealers, San Domingo mahogany means mahogany of a certain density and it does not have to come from San Domingo. Unless otherwise agreed between the 2 companies, a court would find that the meaning based on density applies. Generally, a business attorney would do not advocate for a contract to be governed by these “invisible” terms. If a buyer believed in his mind that San Domingo mahogany must come from San Domingo and that type of product was very important to his business, the implied term that the mahogany did not have to come from San Domingo could have a disastrous impact on the business. The rights and obligations in a written term are easier to understand than are the rights based on an unwritten course of dealing or industry-wide usage of a term. Comment 2 to UCC § 2-202, provides that course of dealing and usage of trade will be assumed part of the contract, “unless carefully negated.” The language in the contract has to be strong to negate those terms. The following is an example of a strong term: Evidence of trade usage or of course of dealing must not be used (a) to provide additional terms to this contract and/or (b) to interpret the terms of this contract. That term is very easy to add to a contract and it can avoid the “invisible” terms but in practice it is difficult to find contracts that use that type of term. W. Mark Mullineaux

Recent years have seen a growing interest in the adoption of environmentally sustainable and socially responsible practices by businesses.  On October 24, 2012 Governor Corbett signed into law Chapter 33 of Title 15 (the Pennsylvania Associations Code) which authorizes the organization of a new form of business corporation that offers entrepreneurs and investors the option to build, and invest in, businesses that operate in a socially and environmentally responsible manner.  Enforcement of those responsibilities will come not from governmental oversight, but rather from provisions on transparency and accountability included in Chapter 33.  A new corporation can be formed as a benefit corporation and an existing business corporation may elect to become a benefit corporation by a two-thirds vote of its shareholders.  If this is a subject of interest to you I would be happy to provide you with more information about it. By: Alan H. Molod

There is almost no such thing as a “standard” contract.  Each contract is unique and merits the attention of an experienced lawyer to raise the proper questions and deal with the proper issues.  Although your review will not be from a legal point of view, but rather from a layman’s point of view, you can at least read and react to what is set forth in the contract.  The real challenge, which requires an experienced lawyer, is to know what is absent from the contract but should be there.  Are you skilled at reading between the lines or can we help? By: Ronald Glazer

Customers who don’t pay their bills are an annoying aspect of the business world. Because customers are the backbone of our business, we are hesitant to be too demanding in our dunning efforts, and even more reluctant to sue. Creditors are always hopeful that the bill will be paid and further orders were given. We do not want to incur the wrath of a now and future customer by being too insistent about coming to grips with an outstanding invoice. Yet, studies show that the longer a business’s bill is unpaid, the less likely it will ever be paid. Creditors write off a large percentage of billings to bad debts. To avoid these problems, early preparation can be helpful. Identifying the precise customer is a simple task that is not always handled properly. Creditors should try to get the customer’s composition, i.e., proprietorship, partnership, corporation, joint venture or otherwise, of customer or the exact name of the entity. Credit issuers tend to deal with one representative of the customer, such as an officer, credit manager, division head or adjuster, and to address communications and billing to that person. Getting a credit application of some kind completed is a big step in accomplishing this. If you intend to charge interest on overdue billings, that fact must be stated before starting work. Merely setting that forth on subsequent invoices may not be binding, because it may not be considered to have been part of the original terms of engagement. Putting this in a signed credit application should be considered. The same holds true as to a clause giving you the right to attorneys’ fees if referred for collection. There comes a time when a creditor and customer part ways and a bill remains unpaid. A creditor may rebill for a while, or write letters that become increasingly ungracious or make calls. If responses or promises are received, and the debt is acknowledged, a confirmation letter should be sent. Although it may seem self-serving, it may become another piece of uncontradicted evidence in the future. When you are totally ignored, or dunning efforts result in counter-threats, it is time to step back and consider whether you want to write the debt off or proceed with legal action. You may want to think about referring the case to outside counsel. You’ll be able to come to some sort of debt settlement arrangement that suits you and your predicament. An independent attorney will be objective in evaluating your chances of recovery and any settlement offers. You will be less annoyed by the continued paperwork, and all of this may be worth paying a lawyer by the hour or on a percentage basis. There are collection lawyers who are willing to handle these claims on a contingency basis, requesting only that you advance or reimburse costs incurred. Of course, some former customers will want to settle upon receipt of a demand letter from outside counsel. Such a letter is believed to show your serious intent to sue them. You should transmit to the attorney copies of the credit application if there is one, invoices and statements, and relevant correspondence. A compromise is frequently in order. The attorney on a contingency has a stake in your recovery, and will want the largest settlement under the circumstances, but will likely be practical about recommending a compromise. You must look at this as found money once you’ve farmed it out because it is clear you would not have gotten anything by yourself. More than 44 years of experience in commercial and retail collections has led me to conclude that it is your early planning, diligence, and flexibility which will give you the advantage and lead to higher collectibility of receivables from your former customers. By: David I. Grunfeld, Esquire