Regulatory Compliance

Subscribe to Regulatory Compliance

Submitted by Odia Kagan, Partner & Chair of GDPR Compliance and International Privacy.

Does the EU General Data Protection Regulation (GDPR) apply to my brand? This is a question with which many U.S.-based franchisors have been grappling since the GDPR took effect on May 25th. Six months later, the European Data Protection Board (EDPB) has issued, for public comment, guidelines on the territorial scope of GDPR.

Below is a breakdown of the major questions and takeaways for US-based franchisors:

1. Do you have an ‘establishment in the Union’?

●  You could be deemed to have an establishment in the Union (and subject to GDPR) even if you do not have a branch, subsidiary or franchisee in an EU member state.
●  Any real and effective activity, even a minimal one, could satisfy the notion of establishment for the purpose of Article 3(1) jurisdiction, even, in some cases, the presence of a single employee.
●  However, just having a website accessible from Europe is not enough.

2. (If you have an EU establishment) Is your data processing carried out ‘in the context of its activities’?

●  GDPR will apply to your data processing if there is an inextricable link between the activities of an EU establishment and the processing of data carried out by you (a non-EU entity).
●  As non-EU controller, you will not become subject to GDPR simply because you chose to use a processor (a service provider carrying out the data controller’s instructions) in the Union.
●  If you are a controller subject to GDPR and you choose to use a processor located outside the Union and not subject to the GDPR, you will need to ensure by contract that the processor processes your data in accordance with the GDPR.

3. If you do not have an establishment in the EU ̶ do you offer products or services to individuals in the EU? (Art 3(2))?

a)  “In the EU” means physically located in the EU at the time of the offering of goods or services (or the monitoring of behavior, see below). Not citizenship. Not residence.
b)   Does the processing relate to (1) the offering of goods or services or (2) to the monitoring of data subjects’ behavior in the Union?

(1) Do you offer Goods or Services?

●  In order to fall in scope, you need to manifest your intention to establish commercial relations with consumers in the EU. For this, the EDPB uses the concept of “directing an activity” to the EU market, developed in case law by the Court of Justice of the EU (CJEU) with respect to jurisdictional matters. Payment for the services, however, is not required.
●  Some non-exhaustive factors, taken possibly in combination with one another, include:

 mentioning dedicated addresses or phone numbers to be reached from an EU country
 marketing and advertisement campaigns directed at an EU country audience
 using an EU or member state top-level domain name
 mentioning customers domiciled in various EU member states, including client testimonials
 using an EU language or a currency
 offering the delivery of goods in EU member states.

(2) Do you monitor behavior of individuals in the EU?

●  Monitoring can be done both on the internet and through other types of networks or technology involving personal data processing, for example through wearable and other smart devices.
●  Monitoring activities include:

 geo-localization activities, in particular for marketing purposes
 online tracking through the use of cookies or other tracking techniques such as fingerprinting
 personalized diet and health analytics services online
 CCTV
 market surveys and other behavioral studies based on individual profiles, including behavioral advertising
 monitoring or regular reporting on an individual’s health status

4. Do you need to appoint a representative in the Union?

If you are a non-EU controller or processor that is subject to GDPR, you are required to appoint a representative in the Union, unless an exception applies. Local representatives may be held liable for the non-EU entity’s breaches and may be subject to administrative fines and penalties.

If you are not a public authority, you would be obligated to appoint a representative unless your processing is “occasional” and “does not include, on a large scale, processing of special categories of data….or processing of personal data relating to criminal convictions and offences…”, and such processing “is unlikely to result in a risk to the rights and freedoms of natural persons.” The EDPB does not elaborate on these and refers to criteria listed in the WP29 guidance on DPOs for the definition of “large scale processing” (e.g. factors like the number of data subjects concerned; the volume of data and/or the range of different data items being processed; the duration, or permanence, of the data processing activity; the geographical extent of the processing activity.

The appointed representative should be established in one of the member states where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behavior is monitored, are located.

To speak about whether GDPR applies to you and what are the next top steps you should take on your road to GDPR compliance, please contact Odia Kagan, Partner, Chair of GDPR Compliance and International Privacy at Fox Rothschild, okagan@foxrothschild.com; 215-444-7313.

In our last post, we examined some of the types of risk that come with growth. In this post, we discuss some forms of diligence that may be used to better manage that risk.

Diligence on Legal Matters

Are there operating hour ordinances that might affect the business? How about limitations on operating hours or days by the landlord? For foreign expansion, the inquiry is whether it is even legal to sell the goods and services in the foreign market. In the Middle East, not every country allows pork or alcohol products to be sold.

Tradenames and trademark protection are essential, but do you know if there are similar names or businesses already in the market that will confuse your customers? Do prior users exist which could create a threat to your brand? In foreign countries, you need to know whether the name is available for protection and whether it must be registered before selling a franchise.

Does the new territory have different rules on regulation or disclosure? Are there local laws which require disclosures, require registrations, require preapproval of advertising, or permit rescission in the absence of compliance?  U.S. franchisors probably know the national rules, or can acquaint themselves easily with local counsel to learn the rules, but going cross-border requires local knowledge. One needs to know whether the local country franchise laws require or exempt registration, or approval, prior to offering a franchise. Jurisdictions which have special franchise laws often will require mandatory disclosures, or a “quiet period” between offer and acceptance.

The local rules on termination and renewal need to be explored. Some jurisdictions require franchises to be “evergreen” such that they never expire under the law until the franchisee commit a material breach. Some jurisdictions allow termination but require buy backs from the franchisee of inventory, or some type of compensation. Some jurisdictions allow enforcement of restrictive covenants and others invalidate the restrictions as anticompetitive. In some foreign countries, preregistration of intellectual property is required, and the property reverts to the franchisee after a period of operation. Mitigation of these risks need to be baked into the deal from the outset.

Reputational Due Diligence

A frequently overlooked aspect to development is whether the addition of this geography and operator (that is, franchisee) improve the reputation of the brand. One might first start by measuring a baseline of the reputation of the brand, then examining the reputation of the folks who are intended to help you expand the brand. News sources, media and social media sites associated with the shareholders, principals and officers should be reviewed. References should be requested and should be checked. In foreign countries, that might require the use of a translator and/or local investigator. Again, care needs to be taken that even the investigator complies with local laws–including privacy laws, which can be much more restrictive than at home in the U.S.

Financial Due Diligence

In the U.S., we can rely on credit reports, criminal records searches, and electronic searches. Cross-border, data and privacy laws create barriers to common search methods used in the US. The foreign search tasks will take longer and will require more cooperation from the prospect. Foreign data is difficult to assemble and may not be as robust even when it is available.

In conclusion, expansion always requires acceptance of risk, with its many considerations such as taxes, dispute resolution, the cost of compliance and serious consideration of governing law. Expert advice should also be sought when traveling into the unknown.

Change is inevitable in a franchise system, and disclosure then becomes a concern. Disclosure may be a business issue for the existing franchisees, but it becomes a legal issue in the offer and sale of franchises. The question is whether the information would be considered by a hypothetical purchaser of a franchise as significant. Case law is sparse, but certain registration states, such as New York, provide examples of material change requiring disclosure.

Examples of material business changes that must be disclosed are closures or buybacks of five percent or more of the franchises in one year, change of control, management, corporate name, state of incorporation, and commencement of any new product, service, or model line increasing the investment or risk of the franchisee, and discontinuing or modifying the marketing plan of system where the total sales affected could be 20% or more of the franchisor’s business. Material financial changes or defaults will also require disclosure.

Often the timing of the disclosure is problematic because some states require immediate disclosure. In the case of a merger discussion, no disclosure is required until definitive or binding contracts are signed. A non-binding letter of intent does not normally trigger a disclosure obligation. Some material changes must be disclosed immediately and some not for 45 days.

Best practices suggest ceasing new sales until counsel has had an opportunity to review the material change and the steps for disclosure are agreed upon. Even in regulated states, protocols are in place to allow sales during the change process and allow disclosure and sale with subsequent disclosures to occur when necessary.

On Fox’s Immigration View blog, my partner Alka Bahal provides a detailed exploration of the I-9 inspection process, in the wake of a recent surge in I-9 audits carried out by the U.S. Immigration and Customs Enforcement (ICE) agency. All employers in the United States are required to have a Form I-9 on file for all employees to verify their identity and authorization to work in the United States.

We invite you to read Alka’s information-packed post addressing concerns facing employers:

Employers Beware: ICE Is Ramping Up I-9 Audits to Record Levels

The North American Securities Administrators Association, Inc. (“NASAA”) is proposing to revise the instructions in the NASAA Franchise Registration and Disclosure Guidelines (the “Guidelines”) that outline policies and procedures regarding the preparation of a franchise disclosure document (“FDD”). Specifically, NASAA has set forth a proposal for public comment that replaces the “State Cover Page”  to the FDD with three separate pages titled “How to Use this Franchise Disclosure Document”, “What You Need to Know About Franchising, Generally”, and “Special Risks to Consider about This Franchise.”

Currently, the Guidelines require that the State Cover Page include certain standard “risk factors” about the franchised business being offered under the FDD, including dispute resolution procedures, governing law, and personal guaranty requirements. Additionally, registration state examiners may, in their discretion, mandate that additional information be included as additional risk factors, such as the franchisor’s financial condition and operating history. In putting this information on the second page of the FDD, NASAA and the state examiners hope to put prospective franchisees on alert of certain factors that are likely important in their decision-making process.

The first new page, “How to Use this Franchise Disclosure Document”, would require a franchisor to disclose, in table format, certain questions a prospect might have and the corresponding Item in the FDD where that information is contained. Similarly to Item 17 of the FDD that provides a summary of certain provisions in the Franchise Agreement, this page would provide prospects with a roadmap to the FDD. NASAA has noted that many prospects find the FDD overwhelming and this page would hopefully alleviate some of these concerns. However, we are concerned that some of the questions seem to put preconceived notions in a prospect’s head about disclosures contained in the FDD.

The second new page, “What You Need to Know About Franchising, Generally”, outlines certain “general” risks a prospect should be aware before entering into a franchise relationship. These additional risks include discussions on personal liability, additional investment requirements, operating and supplier restrictions, and renewal procedures. A franchisor would need to make these disclosures even if a particular factor was inapplicable to the underlying franchise offering. This seems to be counterintuitive and may only cause additional confusion for prospects and the franchisors that have to answer these questions.

The final new page, “Special Risks to Consider about This Franchise”, replaces the current “State Cover Page” and would, again, allow state examiners to require that certain additional risk factors applicable to the specific franchised business be included in the FDD.

Overall, while we believe the NASAA’s intentions are in the right place, these three pages could very well create more confusion due to the use of leading questions on the first page and disclosure of generalized risks without context on the second page. If approved in its current form, franchisors should be prepared to answer many questions about the information on these first two pages. Public comments on this proposal are due on July 13, 2018, so it is important to propose revisions if you have concerns, as we do! We will continue to watch and report on this development with interest.

Almost every year at the IFA Annual Legal Symposium in Washington D.C., a panel of distinguished franchise attorneys and state regulators will discuss best practices in drafting a franchise disclosure document in compliance with the FTC Franchise Rule.   This year was no different and the workshop “Thorny FDD Disclosure Issues” offered a number of best practices and tips to help draft an FDD that is compliant with federal rule and state law and will breeze through the state registration process:

25388704 – know the rules
  1. Item 2 (Business Experience). Franchise systems often have a difficult time determining what officers to disclosure. The panelists reminded attendees that when making this decision, the franchisor should ask themselves whether “an individual’s involvement in either sales or operations is such that a franchisee would rely on his or her expertise, formulation of policy, or control of the system.”
  2. Item 3 (Litigation). Remember that the FTC Rule requires that all material terms to a settlement must be disclosed regardless of whether the settlement agreement is confidential. Legal counsel should remind franchise system clients of this fact so they are not surprised when state regulators demand the information be included in Item 3.
  3. Item 6 (Other Fees). Remember to distinguish between negotiated discounts in initial fees verses other fees. Item 5 requires disclosure of discounted initial fees during the last fiscal year but Item 6 does not require the disclosure of discounted royalty deals.
  4. Item 8 (Restrictions on Sources of Products and Services). Item 8 requires franchisors to disclose the precise basis by which a franchisor receives consideration for required purchases or leases made by the franchisees. State regulators interpret this as a requirement to specify a percentage or flat fee amount per item. For example, “franchisor receives a rebates of $300 for each oven purchased.”

With such resources as the FTC Compliance Guide, FTC Frequently Asked Questions and NASAA Disclosure Guidelines, it would seem like there should be nothing up for debate when it comes to FDD drafting.   After attending this workshop, however, it is clear that there are always new tips to learn.

 

23006593 – cartoon cowboy rider on the horse throwing lasso

Each year the ABA Forum on Franchising Annual Meeting offers a regulatory roundup on state disclosure and registration issues consisting of a panel of franchise examiners from some of the most difficult registration states. This past year in Palm Desert regulators from California, Maryland and Washington offered their tips, tactics and recommendations for preparing and registering franchise disclosure documents compliant with federal and state law.   Some of the most interesting takeaways to keep in mind while you prepare your FDD include:

  1. Item 3. For any litigation matter that must be disclosed in Item 3 of the FDD make sure you include all pertinent facts even if the franchisor entered into a settlement agreement with the franchisee where the parties promise confidentiality. The franchisor must disclose the settlement terms regardless of any nondisclosure agreement.
  2. Item 5. Do not forget the 14 day rule requires that no money be paid or any agreements be signed until 14 calendar days pass. California regulator, Theresa Leets, panned the surprising number of FDDs that include territory deposit agreements, option agreements or other agreements requiring the payment of a fee that is not disclosed in Item 5 of the FDD and is collected even before an FDD is distributed.   Make it clear in Item 5 when you require any payment and make sure it does not run afoul of the 14 day rule or you will get comments from state regulators.
  3. Item 10. Be mindful of indirect financing to franchisees by affiliates if you are registered in California. Although franchisors are exempt from California’s Finance Lender Law when offering direct financing to franchisees, the same exemption does not apply to affiliates.
  4. Item 13. Be sure to include a description of all intercompany license agreements In Item 13.
  5. Item 21. Conduct due diligence on your accountant. Maryland Deputy Commissioner, Dale Cantone, reminds franchisors that just because someone has a shingle, you cannot assume he or she is licensed to perform audits. During the past year eager newly hired regulators in Maryland took it upon themselves to check the license status of franchisor’s financial statement auditors and found many were unlicensed. This causes huge issues for franchisors. Use a licensed certified public accountant.

Even seasoned practitioners and franchise systems can face pitfalls when registering with states so hopefully these tips should help speed that process along!

Michelle Webster, a franchise financial legal examiner with the State of Washington Department of Financial Institutions, took a few minutes at the start of the ABA Forum on Franchising’s Annual Meeting seminar on disclosures to discuss the registration of franchise brokers in Washington. The main takeaway? If you sell franchises in Washington, then there is a good chance you need to register.

27168210 – vintage stamp with text the evergreen state written inside and map of washington, vector illustration

Third parties selling franchises on behalf of a franchisor must register as franchise brokers. The Washington Franchise Investment Practice Act prohibits a franchise broker from offering or selling franchises in Washington unless the seller is registered separately with the Washington Securities Division.    Franchisors, subfranchisors and their respective officers, managers, members, directors and employees are excluded from the broker registration requirements.   However, Ms. Webster reminded attendees that employees of an affiliate “no matter now integrated the franchisor and its affiliated companies may be.”  She explained the common example of where a franchise system offers multiple brands operated under separate legal entities, then employees of an affiliate, subsidiary or parent of the franchisor must be registered with the Washington Securities Division as a broker for all of the brands where the seller is not employed.

Remember that if you, as a franchisor, engage franchise brokers in the State of Washington, then make sure they are separately registered or else you will receive a comment letter.  The Revised Washington Code declares it unlawful for any franchisor, subfranchisor, or franchisee to employ a franchise broker unless the franchise broker is registered.  Therefore, it is important to make sure that anyone selling on behalf of your franchise system is registered or exemption.  The initial application fee is $50 and there is a $25 annual renewal fee.  The standard form can be accessed here [PDF] or you can apply online here.

International franchisors inbound into the U.S. face a complex set of business decisions and legal regulations.  Even seemingly simple tasks–like properly executing a franchise registration application–can become a time-consuming and expensive endeavor (especially where the franchisor does not have an authorized signatory in the U.S.).  Knowing how and when to request waivers can save time and money.

Notary public working on a document with stamp and padsFranchise registration applications must be signed by the franchisor’s authorized representative. In addition, some of the signatures must be notarized.  Generally speaking, satisfying this requirement requires having the signature notarized at a U.S. embassy or obtaining an apostille. U.S. embassies will have policies regarding scheduling appointments, what documents to bring, and how to prepare documents to be notarized. In addition, notarial services can be significantly more expensive at the embassy than stateside. Finally, embassy representatives are not used to seeing standard franchise applications and disclosure documents, which can cause confusion and delays.

Alternatively, the franchisor can obtain an apostille, a specialized certificate that verifies that a document is legitimate and authentic. Apostilles are only effective between countries that are parties to the Hague Apostille Convention (which is many). First, the franchisor must translate the documents into the local language so they can be notarized under local law. Then the franchisor must obtain an apostille, which ensures the documents and signature are accepted by the U.S. examiner.

Unfortunately, both options can be costly and time-consuming. Therefore, inbound international franchisors and their counsel should inquire whether the U.S. examiner will grant a waiver if obtaining an apostille or notarization will create a financial hardship and undue delay. Examiners understand there are specific difficulties to international franchising and may waive the notary requirement or permit the signatory to obtain notarization when he or she is next in the U.S.  Franchisors or counsel should contact examiners to determine how to properly make the request.  Some examiners will accept requests made in a cover letter to the application or in a preliminary email exchange.

International franchising inbound to the U.S. can be very complex. Obtaining a waiver of the notarization requirement is one less headache, which allows franchisors and their counsel to focus on the substantive issues.

10560779 – closeup portrait of a businesswoman in shock, isolated on white background

Maybe you are an international company with a successful brand that sold a master franchise or area representative right in California without knowing the robust state franchise registration laws. Maybe you are an up-and-coming pizza joint operating in Los Angeles that decide to sell a business associate the right to operate a location under you brand with your recipes in exchange for a fee without considering if it was a “franchise.”

You did not mean to violate the California Franchise Investment Act but it turns out you did. What can you do? Is there any way to “fix” your violation? The answer is yes. Although, California has a very robust and stringent state registration and disclosure process, it also provides a fair remedy for curing these non-compliance issues. The state wants to encourage self-reporting and rewards a franchisor’s attempt to do so by offering a process to bring finality to an illegal sale.

If you or your franchise system client sold a franchise in California without pre-registering with the California Department of Business Oversight, then you will need to prepare a Notice of Violation.   Instructions on preparing a compliant Notice of Violation can be found here. This is a separate application than the general application for registering the franchise offering.   Once approved, you will submit the Notice of Violation to the franchisee.  The Notice of Violation will describe to the franchisee the nature of the violation and the franchisee’s rights under the law.   However, delivery of the Notice of Violation will also start a 90 day statute of limitations clock running shortening the statute of limitation of 4 years from the illegal act or 1 year from when the franchisee discovers the violation.

In most cases, this is a much better option for a franchise system rather than waiting to see if a franchisee becomes disgruntled and reports the system to the California regulators.