Technology Creates Hidden Problems for Businesses With Employees.

It is near impossible to run a business without using technology and having access to email and the Internet.   You may even employ cloud computing, software-as-a-service (SaaS), social networks like Facebook and Twitter to be more productive and increase your business’ visibility. Be careful – implementing technology in your business can create challenges and potential liability!

I am often asked what things should be included in an employee manual or acceptable use policy.  Employers should consider adding an acceptable use policy (AUP) to your employee handbook.  (No company is too small to have an employee handbook – it sets out the “rules of the road” of the company’s expectations of its employees’ conduct, protecting company trade secrets and confidential information, explaining human resource matters and vacation policies, and prohibition on sexual harassment, etc.).

• The acceptable use policy sets forth the expectations of what is the acceptable use of the company’s technology – from the computers and fax machines, to the use of the Internet and email. It also should address computer security, copyright infringement and defamation/slander.
• The AUP should be written in a way to protect the company form rogue employees as well as protecting the employees’ right to free speech and privacy.  Many companies are concerned with their employees’ use of the internet (and go so far to install monitoring and filtering software or appliances, which may not be appropriate for your company).  At the end of the day, the AUP should protect the company’s best interests.

Consider the following that you may want to address in your AUP:

• Do you have a valid business reason to monitor your employee activities?
• Is there certain company information that needs to be protected or kept confidential?
• Can you identify which employees that have a “need to know” sensitive data?
• What measures does your company have in place to address disaster recovery, back–up and physical and network security (data encryption, password policies, etc.)?

With respect to respecting your employees’ privacy, generally, email and internet activity may be monitored for valid business purposes (note, each state may have their own privacy laws). So, subject to your state’s laws, it is recommended that your employee’s consent in writing to having their email and internet activities monitored (and perhaps include procedures for when you may disclose email data files to third parties (e.g., as required by law or pursuant to a court order)).

Employee Internet Access

Your employees probably need internet access to support their job functions, but their use for non job-related activity can expose your company to liability.

• It is wise to prohibit employees’ from accessing porn or adult web sites in your AUP (or use filtering mechanisms). If an employee visits a porn site from the workplace, then your company might be found guilty of facilitating a “hostile work environment” under sexual harassment laws. A forensic expert could find the porn sites’ “cookies” on the hard drive that could be used as evidence in a sexual harassment or employment discrimination lawsuit. Internet use should be limited to company-related activities.

An E-Mail Is Not Like A Phone Conversation

People need to treat their e-mail messages more like a written letter than a phone conversation. You need to keep in mind that an email message can be permanently stored (and can haunt you later if retrieved for litigation) and can be easily disseminated with a press of the “forward” button. As seen all too often on the nightly news, e-mail and text messages have contained the most damning evidence in sexual harassment and employment discrimination lawsuits.

The email AUP needs to:

• prohibit email messages that contain any type of offensive, harassing, fraudulent, defamatory, or otherwise illegal language. Perhaps employees should get a personal email address outside of work (like gmail), and you should decide whether your company wants to permit the use of work computers for the employee’s occasional sending or receiving personal email during work hours.
• address company confidential information, trade secrets and communications of client information (you might prohibit any transmission of same unless using encryption technology).  Also, your company may be governed under federal or state privacy laws like HIPAA or Graham-Leach-Bliley, which governs the use and disclosure of personally identifiable information.
• address downloading of email attachments (virus risks, copyright issues, etc.)

Lastly, you should consider including in the AUP possible disciplinary actions which may be brought against an employee in the event the AUP is violated (perhaps ranging from a warning, to loss of Internet, or even termination).

**This post is for informational purposes only, For legal advice contact a business and technology lawyer**

Back in February 2010, Google launched a new social network tool called “Google Buzz.” Google Buzz allowed Gmail users to share status updates, images, and videos.   It also sent real-time updates of a Gmail account user’s Google Buzz feed that showed up on Google’s mobile maps on Android and iPhone mobile phones.

The problem was that Google Buzz violated Gmail users’ privacy by automatically enrolling Gmail users in Google Buzz and publicly exposing private user data.  Within weeks following Google’s launch of Google Buzz, a class-action lawsuit was filed claiming that Google Buzz violated the Computer Fraud and Abuse Act of 1984 (CFAA) (In re Google Buzz User Privacy Litigation, Case No. 5:10-cv-00672-JW).  CFAA protects individuals from hackers, Trojan horses, and other software and devices that could compromise the confidentiality of data stored on a computer.  One of the problems with Google Buzz was that initially Gmail users had no way of opting out of disclosing their personal computer connections.  A common complaint of Gmail users was that  their email recipients were not necessarily the same people they may want in their social networks.

Yesterday (November 2, 2010), Google contacted millions of its Google Buzz users notifying them that it had settled the class-action lawsuit.

In accordance with the settlement, Google will establish an $8.5 million “Common Fund” to “fund organizations focused on Internet privacy policy or privacy education” (and pay the plaintiff’s lawyers’ fees and other expenses) and promised to “do more to educate users about the privacy aspects of Google Buzz.”  More information about the settlement can be found at http://www.buzzclassaction.com.

What is the impact of the settlement on Gmail Users?  Basically it has no monetary impact.  Gmail users will not receive any compensation from the settlement.

In accordance with the settlement found at www.buzzclassaction.com, Gmail users have 4 options:

• Opt out of the settlement (your notice must be received by December 6, 2010).
• Object to the Court about why you do not like the Settlement (objection must be received by January 10, 2011).
• Go to a hearing and ask to speak in Court about the fairness of the Settlement (your written Notice of Intent to Appear must be received by January 10, 2011).
• Do nothing and give up your rights to sue Google, thus accepting the terms of the settlement.

**This post is for informational purposes only, For legal advice contact an internet lawyer**

A Non-Disclosure Agreement (also known as an NDA or confidentiality agreement) is meant to protect a business from its employees misusing valuable proprietary information.  Often it is a good idea to have a confidentiality agreement in place with each of your employees (regardless of position).  For instance, your receptionist and salesperson might have access to your customer lists, which your company would deem confidential.

You should not use a “form” NDA that you download from the internet or obtained from another business.  Your NDA should be customized for the facts and opportunity at hand and more importantly, for your particular business.  It is important to keep in mind that your company’s confidentiality which is designed for the purpose of a “business-to-business” transaction (where both corporate parties disclose confidential information to each other) won’t suffice for the employer-employee relationship.  You should consult a New York Business Lawyer (or corporate attorney) to prepare your company’s employee confidentiality agreement.

Your employee non-disclosure agreement should be specific as to what is considered “confidential information” and also include things that the employee ought to reasonably know is confidential.  You should also include company trade secrets (see “When Do You Need a Nondisclosure Agreement (NDA)?” for more discussion about Trade Secrets).

Your corporate attorney should set forth for what purposes the employee can use the confidential information and how he or she can use the confidential information (may not be removed from the offices, no reverse engineering, no copying, etc.).  Of course, you need to have provisions specifying what the employee must do with the confidential information when his or her employment ends.

Your company lawyer needs to add “teeth” to the NDA stating that employee indemnifies the company for any breach and that the company may resort to any remedy at law or in equity to enforce its rights in the proprietary information (this means the employee could be sued for monetary damages as well as enjoined from using the information).

Of course, depending on what your business does, an employee confidentiality agreement may be part of a more encompassing agreement that includes provisions limiting the competitive activities of an employee when he or she leaves your company (sometimes referred to as a “non-compete agreement” or “forfeiture for competition agreement”) and requiring the employee to disclose prior inventions (and promise to either not include the prior invention in what they create for your company and/or grant your company a royalty free license to otherwise use the prior inventions).

Lastly, like protecting trade secrets, it is not enough to merely have non-disclosure agreements (confidentiality agreements) in place — your company needs to implement policies and procedures to maintain the secrecy of your company’s confidential information.

I recommend that you consult with a New York Business Lawyer to prepare your company’s employee confidentiality agreement, “non-compete agreement” or “forfeiture for competition agreement” to help ensure the best ways to protect your company’s confidential information and competitive edge.

There are plenty of reasons to have an NDA.  I will limit this post to discussion of using an NDA between technology businesses in an arms-length transaction. More often than not, for whatever reason, whenever there is a technology related transaction at hand, the parties want to sign nondisclosure agreements right away.   On one hand, it is very advantageous to make sure your confidential information and trade secrets are secure.  On the other hand, I don’t advise exchanging confidential information with strangers right away.  Regardless of whether there is a signed NDA in place, it is best to keep your secrets to yourself until your interest in the opportunity at hand is piqued to the point where you believe the potential relationship might get serious.

Up until that point, a technology company can demonstrate its capabilities without necessarily disclosing the “secret sauce” of “how” it does it (note, if the capabilities are is as much a secret as “how” it does it, then this may not apply).

You should not sign a “form” NDA. Each NDA should be customized for the facts and opportunity at hand. You should call us (or another New York Business Lawyer or corporate attorney), highly experienced in business and technology matters to review, negotiate and revise any form NDA presented to you to sign.

A Nondisclosure Agreement is more than a commitment to keep your confidential information secret — you also don’t want the other party to use your confidential information for their own benefit.  You want to protect your ideas with the NDA.  As the old saying goes (absent a promise to keep a secret), “ideas are as free as the wind.”  Copyrights can protect your “expressions” of an idea (like music, a novel, software code, or a photograph or painting, among other things); and a patent can protect your idea that is used to create a nonobvious and useful invention.  But an idea is free to copy – so you need to protect them as a secret.  This means that other party should never be able to use your idea freely; a well drafted NDA should limit the purposes for which the confidential information may be used.

Trade Secrets.  A trade secret is an idea that derives independent economic value from not being generally known to the public or readily ascertainable by proper means by third parties who could obtain economic value from its disclosure.   You can’t just say that some information about your business is a trade secret.  You have to take efforts to keep it secret (like keeping the formula to Coke in a safe and have employees sign NDA’s).   You should also take care in the NDA to distinguish the treatment of confidential information and trade secrets.  This is important because most NDAs have an expiration date after which a party is free to reveal the confidential information (e.g., either an express term or a certain period of time following the date of disclosure).  You never want an expiration date with respect to the obligation of keeping a trade secret confidential.  You also never want to have too long of a term to keep regular confidential information secret (especially in the world of technology where the information could be obsolete in a couple of years).

Having said this, if you’re revealing a trade secret, which you should do in the rarest of occasions, the obligation to maintain the secret should be an absolute must, and in all events, last forever.  This is because once an obligation to maintain the information confidential is gone, then it no longer can be deemed a trade secret (the toothpaste is out of the tube and cannot be put back).  Courts will not protect your right in that trade secret after you’ve consented to it being publicly revealed.

**This post is for informational purposes only, For legal advice contact a business lawyer**