SteveK November 18th, 2009

In Beverly Square Association, Inc. vs. Zoning Board of Adjust of the City of Trenton et al., the New Jersey Appellate Division held that a property owner, applicant for permit to renovate a prior non-conforming use, has the ultimate burden of proof that the prior use had not been abandoned. In the case, the defendant was issued a permit to renovate 20 residential apartments deemed by the Trenton zoning officer to be a preexisting non-conforming use.  Beverly Square Association appealed the decision to the Trenton Zoning Board of Adjustment, arguing that the defendant’s nonconforming use had been abandoned (i) after a tax foreclosure on the property, and (ii) as a result of the 18-month vacancy and state of disrepair. The Board affirmed the decision of the zoning officer, which was appealed to the Superior Court. The Court reversed finding that the property owner failed to prove that the use had not been abandoned.

 The Appellate Court determined that the objector must initially come forward with sufficient evidence of temporal or physical abandonment; however the property owner had the ultimate burden of proof as to the intent to resume the prior non-conforming use of the property within the 18-month period provided in the municipal ordinance. The Court remanded the case to trial court for the matter to be considered in with the clarification on the burden of proof.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( http://www.dbnjlawblog.com) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of parties in zoning, land use and local government matters. For additional information about the matters in this bulletin or in the firm’s land use, zoning and municipal please contact Jeffrey B. Lehrer, Esq.

Tags: Land Use Law, Local Government Law

• Land Use & Zoning , Municipal Law
• Comments Off

SteveK November 16th, 2009

By

Steven A. Kunzman, Esq.

And

Todd B. Ruback, Esq., CIPP

Privacy Overview

 The pervasive use of the Internet as a business platform and for the collection, use and transmission of personal information presents fertile ground for the growth in claims arising from data breaches and improper privacy practices. As these claims arise, they will undoubtedly be tendered to insurers for defense and indemnification under various commercial policy forms, including those recently developed to provide coverage for privacy claims.[1] Insurance companies must be cognizant of the changing winds on the privacy landscape.  Due to increasing regulatory compliance requirements and a spike in privacy related litigation flowing from record setting data breaches, organizations and insurance carriers will undoubtedly be faced with privacy as a significant risk component to business.  According to Verizon Business’s 2009 Data Breach Investigation Report, 2008 saw more reported data breaches than the previous four years combined, with 285 million records breached. [2]  The Poneman Institute estimated in its 2009 Annual Study that the average cost for a data breach exceeded $200 per record for organizations that were first time victims of a data breach.[3]  Numerous class action suits for privacy violations have been filed, the most famous of which is against Heartland Payment Systems, for a massive breach caused by external hackers.[4]  Additionally, the FTC and Attorneys General of states across the country appear to be stepping up enforcement actions against companies for improper privacy practices.

 The likelihood of an organization facing a privacy-related claim for liability or a regulatory enforcement action for improper privacy practices has increased significantly.  Concordantly, claims for coverage under insurance polices will increase significantly over the coming years. Although the present anticipated harm to any individual does not appear to be significant, these claims will have an impact on an insurer by increasing costs for claims processing, investigation, incident response management, complying with statutorily required breach notification processes, litigation defense and payment of claims, particularly the costs for any class action claims.

Privacy Litigation and its Impact Upon the Insurance Carrier

 Some background in privacy issues is helpful to put these potential claims into an understandable context. There are two components to privacy:  data protection and privacy practices.  Both components are governed in large part by either regulation or statute, and in some cases by common law. 

 Data Protection:            Data Protection encompasses the security of data that contains personal information.  There are generally three elements to security: technical, physical and administrative.  Industries such as financial services and healthcare have security standards as respectively enumerated in the Gramm-Leach-Bliley Act (GLBA) and Health Insurance Portability and Accountability Act (HIPAA).  Further, the payment card industry has created its own technically objective security standard, PCI-DSS, which applies to many organizations that accept payment cards.

 A security breach may take many forms, some of which include the unauthorized access to personal information by   an external source such as a hacker or an outsourced service provider, the unauthorized access to personal information by an internal source such as an employee or contractor, or something as simple as the theft of a company laptop that contains personal information 

Private party lawsuits against companies for failing to protect data due to deviation from certain standards are based upon a negligence theory.  To date plaintiffs have had difficulty prevailing on negligence claims, although there have been numerous and significant settlements.[5]  The challenge plaintiffs have faced is in proving actual damages that were proximately caused by the defendant’s failure to protect personal information.6  Some courts, however, are beginning to view data breach litigation in a similar light to toxic tort medical monitoring claims in that the threat of future harm may be sufficient to sustain a claim.7  If this “future risks” approach to data protection litigation gains traction, then insurance companies can look forward to more protracted and costly litigation, with the potential for significant jury awards under the class action umbrella.

 Privacy Practices:            Privacy practices that may be subject to claims include: improper collection, use, or transfer of personal information; the improper collection of information using unauthorized cookies, spiders, spy ware, or other technological means; failure to protect personal information according to a company’s posted online privacy statement; having a privacy statement that does not meet regulatory requirements8 spamming, improper faxing or telemarketing, and the commission of privacy torts such as the invasion of privacy.  For companies that transact online business in not only the United States, but also the European Union (EU) where the laws on privacy practices are greatly different, compliance become complex and risk of an improper privacy practice rises greatly.

 Companies committing improper privacy practices are often subject to multiple layers of penalties or fines not only in the EU but also in the United States.  For example, if a company fails to protect personal information according to its posted online privacy statement, it may be subject to an investigation and penalties from both the Federal Trade Commission (FTC) and state authorities for unfair/deceptive online trade practices,9 in addition to the potential private claims for violations of state consumer protection laws.  In essence, a company may pay three times for the same transgression in the US.  Although insurance policies generally exclude coverage for regulatory or enforcement actions by governmental bodies, the exposure is presented in private litigation, which may require aggressive defense of the regulatory claim.  It appears, however, that some of the new privacy insurance policies may offer coverage for regulatory matters. 

 Insurance Coverage:  Coverage Part B of a typical Comprehensive General Liability  (CGL) insurance policy generally includes coverage for damages cause by “personal injury” and “advertising injury.” Although those representing the insured often consider this section of the insurance policy to provide an expansive grant of coverage, this coverage is usually considered by the insurer to be limited to a number of specified claims such as personal injury, which is often defined in a CGL policy as “an injury arising out of…violation of an individual’s right of privacy.”  Part B of the policy states that the insurance applies to personal injury if “caused by an offense…[a]rising out of the conduct of your business, excluding advertising, publishing, broadcasting or telecasting done by or for you.” These policy forms were surely designed without any contemplation of the current risks since they have only come into existence with the pervasive use of computers and the Internet to transact business. In addition, there may be issues as to when the “injury” has taken place; at the time of the breach or the time when the personal injury is actually sustained.  In order to be able to properly evaluate and assume the risks some insurers have, therefore, developed policies to specifically address the risks presented. Undoubtedly if claims continue to rise and develop as anticipated, insurers may dispute coverage and/or respond to the claims being asserted based upon polices that, at the time of issuance, did not envision the present risk of injury caused by data breach.  Management of the risk therefore requires a thorough understanding of the nuances of the laws and requirements of   best of breed privacy practices

 Conclusion

The changing privacy landscape will have a tangible impact on an insurance carrier’s costs of responding to claims under the personal injury and advertising portions of the CGL policies and under specifically designed policies.  Foresight in addressing these

risks and an understanding of the landscape of privacy laws and issues will be an

essential component to underwriting the risks and defending the claims.

 End Notes

[1] Zurich North America Commercial Expands Security, Privacy Insurance Coverage, http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=218400572

2 Verizon Business 2009 Data Breach Investigations Report, By Wade Baker, April 15, 2009

3 Poneman Institute’s Fourth Annual US Cost of Data Breach Study, By Dr. Larry Poneman, January 2009

4 In Re: Heartland Payment Systems, Inc. (626 F. Supp 2d 1336; 2009 U.S. Dist. LEXIS 81493) (Order 

  granting consolidation of class action lawsuits.)

5 See, In re TJX Cos. Retail Sec. Breach Litig., 246 F.R.D. 389; 2007 U.S. Dist. LEXIS 87920 (over $40M settlement) and Department of Veterans Affairs Data Theft Litigation, No. 06-0506 (D.D.C. January 27, 2009) ($20M settlement)

6 See, Forbes v. Wells Fargo Bank, N.A., 420 F. Supp2d 1018, 1021 (D.Minn.2006); Giordano v. Wachovia Sec., LLC., 2006 2177036 (D.N.J. July 31, 2006) (unpublished); Guin v. Brazos Higher Educ. Serv. Corp., Inc. 2006 WL 288483 (D. Minn.) Feb 7, 2006 (unpublished); Hendricks v. DSW Shoe Warehouse, 444 F. Supp. 2d 775, 783 (W.D. Mich. 2006)

7 See, Pisciotta v. Old Nat. Bancorp, 499 F.3^rd 629 (7^th Cir. Aug. 21, 2007)

8 See, GLBA

9 See, Pinero v. Jackson Hewitt Tax Services, No. 08-3535 (E.D. La. Jan 7, 2009)

 Todd B. Ruback, Esq. is chair of the Privacy and Technology Practice at the law firm of DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, P.C.  He is also a Certified Information Privacy Professional (CIPP) and thought leader in the area of privacy law.  He has authored or co-authored numerous publications on privacy and is also a lecturer at various privacy seminars and conferences.  He is a present nominee to be on the Board of Directors of the International Association of Privacy Professionals (IAPP) for the upcoming term of 2010-2015 and will be a speaker at the IAPP International Privacy Convention to be held in Washington, D.C. in April 2010, where he will lecture on trends and risk in privacy litigation. 

 Steven Kunzman, Esq. is the chair of the Insurance Coverage Practice of the law firm of DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, P.C.  He has been providing counsel and representation to insurance companies on insurance coverage matters and defense to insurance company clients for over 25 years.  

Tags: insurance law new jersey, Privacy Law, Technology Law

• Corporate Law , Defense Litigation , Insurance Law , Privacy Law , Technology Law
• Comments Off

SteveK November 13th, 2009

The NJDEP has recently issued documents to provide direction and guidance for remediation of contaminated sites by Licensed Site Remediation Professionals (LSRPs) including Administrative Requirements for the Remediation of Contaminated Sites (ARRCS) Rules and the Guidance for the Issuance of Response Action Outcomes (RAO) under Site Remediation Reform Act, N.J.S.A. 58:10C-1 et seq. (summarized in a prior posting NJ Governor signs law addressing remediation of contaminated properties ). The Guidance for Issuance of the RAO provides direction to the regulated public and the LSRPs in the structure and requirements for the appropriate issuance of an RAO, which, in essence, replaces the No Further Action letter (NFA).  Under the SRRA an RAO constitutes the LSRP’s professional opinion that there are either a) no longer discharged hazardous substances or wastes present at the site or in the area that requires remediation (area of concern or AOC), or b) that are no discharged contaminants at the site, AOC, or migrating from the site above the regulatory limits for such substances, and the remedial action taken was “protective of public health, safety and the environment.” 

The two primary factors to determine which RAO is to be issued:

The scope of the remediation: whether the remediation will involve the entire site or just particular areas of concern; and

Whether the remedy will involve institutional or engineering controls.

The Guidance suggests that reporting obligations can be streamlined when the scope of the remediation involves the entire site as opposed to submissions on each AOC.  Institutional controls can be employed where they “protect the public health and safety and the environment.”  The LSRP is to designate each RAO according to the following categories:

An Unrestricted Use RAO: where there are no contaminants found or where all contaminants are remediated to the most stringent standards.

A Limited Use RAO: where a) the soil is remediated at a non-residential site to the more restrictive standard of either non-residential direct contact or the impact to ground water soil standard, and there is a remedial action permit issued by the NJDEP for a deed notice, or b) contaminants exist above applicable remediation standards for ground water, no engineering controls are employed, and the NJDEP has issued a ground water remedial action permit.

A Restricted RAO: where an engineering control, in combination with an institutional control, has been issued by the NJDEP to ensure that the remedy will provide protection for the long-term.

The Guidance sets forth when it is appropriate for an LSRP to issue an RAO, including when contaminants remain on site. The NJDEP identifies 9 scenarios where it is permissible to issue an RAO when contaminants remain on site.  Some the scenarios include: where the contamination is migrating onto the subject property and the actions on the site did not contribute to the contamination; where there are naturally occurring contaminants; where contamination has been remediated and a remedial action permit with engineering controls has been issued; where groundwater contamination is found on-site that has not triggered a ground water remedial investigation and has not otherwise been investigated; where the remediation has been completed under an approved RAW but the standards have changed in the interim.  RAOs involving ground water remedies can be issued where the ground water is remediated to Ground Water Remediation Standards, which allows an unrestricted RAO; where ground water remains above the Standards where a limited use restriction is employed (which requires that the LSRP demonstrate a decreasing trend of contaminants), or that contaminants remain above Standards due to the technical impracticability of achieving the Standards (requiring engineering controls and remedial action permit.)

The Guidance includes a shell RAO to be followed by the LSRP. The shell document presents language to be used by the LSRP for the various remedial options.  The LSRP is prohibited from modifying the language of the shell RAO unless specifically permitted by the Guidance.

The regulated community, their counsel and consultants have been eagerly awaiting direction from the NJDEP on the new program with the hope that the process will be more efficient, that site closure can be effectuated more quickly and that the costs will also be decreased without compromising the health and safety of the public and the environment. The Rules and Guidance documents that have been issued have begun to provide the framework for the new program; hopefully the expectations of the public will be realized.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( www.dbnjlaw.com ) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of clients in environmental matters. For additional information about the matters in this bulletin or in the firm’s environmental practice, please contact Steven A. Kunzman, Esq. who heads our Environmental Department.

Tags: Environmental Law

• Environmental Law
• Comments Off

SteveK November 11th, 2009

In Kanafani v. Lucent Technologies, plaintiff, a former employee of a subsidiary of Lucent Technologies, asserted violations of the New Jersey Conscientious Employee Protection Act (CEPA), in addition to claims pursuant to the New Jersey Wage and Hour Law. Plaintiff’s whistleblower claims were based on both his initial June 2006 termination and the decision of defendant not to rehire him in September 2006. Two months prior to his termination, plaintiff sent an email to Lucent executive outlining what he saw as an improper inflation of reported revenues and violations of the Foreign Corrupt Practices Act in connection with sales efforts in the United Arab Emirates. After  the close of discovery, Defendants sought dismissal of all claims. The District Court dismissed plaintiff’s the Wage and Hour Law violation clams, as well as all claims related to the September 2006 refusal to rehire; the did not dismiss the claims related to the June 2006 termination.

One of the primary arguments presented by Lucent related to a release that was entered into by the plaintiff upon termination, which defendant argued barred the claims.

The Court rejected defendant’s argument regarding the absence of a causal nexus between the activity and the termination, finding questions of fact required a trial.  In addition, the Court noted that the language in the release that plaintiff had “no further rights or claims to any past or future payments or reimbursements from the Company” was not an unambiguous waiver of his rights under CEPA, and that this ambiguity should be read against the Defendants and would be subject to further consideration at trial. The ruling is consistent with other decisions in New Jersey that requires any release of certain forms of claims should be specified.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( http://www.dbnjlawblog.com) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of parties in employment matters. For additional information about the matters in this bulletin or in the firm’s Employment Practice, please contact Richard P. Flaum, Esq.

Tags: Environmental Law

• Employment Law
• Comments Off

SteveK November 11th, 2009

On November 4, 2009, in Taylor v. Amcor Flexibles, Inc., the United States District Court, dismissed the claim of a plaintiff asserting that the disclosure of negative employment evaluations to a prospective employer is not inherently discriminatory.

Plaintiff Alonzo Taylor, an African American, began his employment with defendant Amcor Flexibles in early 2005. By November of that year, defendant became displeased with plaintiff’s performance and placed him on a Performance Improvement Plan. After his performance failed to improve, plaintiff was terminated. Over a year later, defendants responded to an inquiry from a prospective employer for the plaintiff indicating that he was released for performance issues. Plaintiff thereafter filed suit for racial discrimination pursuant to Title VII, the New Jersey Law Against Discrimination (NJLAD) and for retaliation under the Conscientious Employee Protection Act (CEPA), as well as common law defamation. The Court employed the McDonnell-Douglas test and concluded  that although plaintiff made out a prima facie case of discrimination, defendant was able to articulate a nondiscriminatory reason for dismissal. The Court stated that it did not wish to second guess that criteria used to evaluate employees, absent a showing that the criteria utilized was inherently discriminatory. The Court, therefore, granted Summary Judgment to the defendant.

 Finally, although defendants did release unfavorable information regarding plaintiff to a possible subsequent employer, the Court found that since plaintiff signed an authorization for the release of the information, the qualified privilege of course of legitimate business functions attached. The Court therefore dismissed plaintiff’s defamation claims.

DiFrancesco, Bateman, Coley, Yospin, Kunzman, Davis & Lehrer, PC ( http://www.dbnjlawblog.com) is a full service law firm in New Jersey which provides a broad range of legal services, including the representation of parties in employment matters. For additional information about the matters in this bulletin or in the firm’s Employment Practice, please contact Richard P. Flaum, Esq.

Tags: Employment Law

• Employment Law
• Comments Off